Sample viewer

vx.netlux.org/Trojan.DOS.IRSCalc

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:49:55.091017101Z 53 PC: 140aa | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:49:55.101534565Z 53 PC: 140aa | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:49:55.103895408Z 53 PC: 140aa | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:49:55.105897893Z 53 PC: 140aa | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:49:55.107449553Z 53 PC: 140aa | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:49:55.109755294Z 53 PC: 140aa | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:49:55.111415489Z 53 PC: 140aa | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:49:55.113011473Z 53 PC: 140aa | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:49:55.115746225Z 53 PC: 140aa | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:49:55.118033784Z 53 PC: 140aa | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:49:55.120638419Z 53 PC: 140aa | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:49:55.122988341Z 53 PC: 140aa | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:49:55.12472143Z 53 PC: 140aa | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:49:55.12613381Z 53 PC: 140aa | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:49:55.129022602Z 53 PC: 140aa | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:49:55.130546015Z 53 PC: 140aa | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:49:55.132204517Z 53 PC: 140aa | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:49:55.13420031Z 53 PC: 140aa | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:49:55.135483004Z 53 PC: 140aa | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:49:55.136979613Z 37 PC: 140bf | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:49:55.139544205Z 37 PC: 140c7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:49:55.140849681Z 37 PC: 140cf | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:49:55.14256441Z 37 PC: 140d7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:49:55.144211317Z 68 PC: 14b84 | I/O control for devices (Set for = '�3��d��`�!s���%�3��'��B�%�d�����0����>s')
2018-12-17T22:49:55.177915612Z 37 PC: 139e1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:49:55.18141652Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:49:55.1827038Z 78 PC: 13f91 | Find first file
2018-12-17T22:49:55.187228561Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.535688803Z 65 PC: 148b9 | Delete file (Filename = 'C:\IO.SYS')
2018-12-17T22:49:55.548587461Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.551562576Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.555854652Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.566509458Z 65 PC: 148b9 | Delete file (Filename = 'C:\MSDOS.SYS')
2018-12-17T22:49:55.578712631Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.58019286Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.583362882Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.585983852Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.589472088Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.591233946Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.596356485Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.607852726Z 65 PC: 148b9 | Delete file (Filename = 'C:\COMMAND.COM')
2018-12-17T22:49:55.620124316Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.621567076Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.625026411Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.626189324Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.630482706Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.645780518Z 65 PC: 148b9 | Delete file (Filename = 'C:\CONFIG.SYS')
2018-12-17T22:49:55.658443521Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.660187937Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.664762244Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.675309367Z 65 PC: 148b9 | Delete file (Filename = 'C:\AUTOEXEC.BAT')
2018-12-17T22:49:55.68776079Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.690409396Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.693805829Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:49:55.695444141Z 78 PC: 13f91 | Find first file
2018-12-17T22:49:55.703894739Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:49:55.705457105Z 78 PC: 13f91 | Find first file
2018-12-17T22:49:55.715913704Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.718797021Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.723180703Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.724585067Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.729468463Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.743605684Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\ATTRIB.EXE')
2018-12-17T22:49:55.752694628Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.753754044Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.756914309Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.768075163Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\CHKDSK.EXE')
2018-12-17T22:49:55.780510733Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.783015576Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.787122289Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.79838444Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\COUNTRY.SYS')
2018-12-17T22:49:55.812296895Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.814063934Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.818620874Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.830903185Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\COUNTRY.TXT')
2018-12-17T22:49:55.84303499Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.844650677Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.849804734Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.861350906Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\DEBUG.EXE')
2018-12-17T22:49:55.87399541Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.876444725Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.881395316Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.8924112Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\DOSSETUP.INI')
2018-12-17T22:49:55.905695048Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.908163042Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.912688096Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.924121986Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\DRVSPACE.BIN')
2018-12-17T22:49:55.937030953Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.938666064Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.944143481Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.957144262Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\EDIT.COM')
2018-12-17T22:49:55.969237347Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:55.970856257Z 79 PC: 13fae | Find next file
2018-12-17T22:49:55.976300255Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:55.987918358Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\EXPAND.EXE')
2018-12-17T22:49:56.000137437Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.002444788Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.007933286Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.017357081Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\FDISK.EXE')
2018-12-17T22:49:56.024595947Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.026202227Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.028865237Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.036065173Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\FORMAT.COM')
2018-12-17T22:49:56.044095319Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.045174804Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.047905162Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.055312457Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\KEYB.COM')
2018-12-17T22:49:56.063021931Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.064282509Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.067651447Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.075327618Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\KEYBOARD.SYS')
2018-12-17T22:49:56.083517492Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.085865625Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.089055005Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.101054692Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\MEM.EXE')
2018-12-17T22:49:56.118597977Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.121060837Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.125860184Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.13900197Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\NLSFUNC.EXE')
2018-12-17T22:49:56.151790414Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.153472303Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.158168282Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.170732213Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\README.TXT')
2018-12-17T22:49:56.183953231Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.185501049Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.190480859Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.201936908Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\NETWORKS.TXT')
2018-12-17T22:49:56.215570655Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.217949097Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.222811394Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.234398654Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\QBASIC.EXE')
2018-12-17T22:49:56.248747692Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.25061761Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.255229941Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.267954654Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\REPLACE.EXE')
2018-12-17T22:49:56.281032208Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.28260814Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.28721471Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.299809788Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\RESTORE.EXE')
2018-12-17T22:49:56.312075401Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.313644187Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.318979307Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.331570896Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\SCANDISK.EXE')
2018-12-17T22:49:56.341747295Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.343622624Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.346416885Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.353294972Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\SCANDISK.INI')
2018-12-17T22:49:56.362976223Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.36461459Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.368277326Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.377641978Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\SETUP.EXE')
2018-12-17T22:49:56.38952973Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.39084013Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.39612205Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.414062962Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\SYS.COM')
2018-12-17T22:49:56.4264162Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.42847522Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.433138515Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.444712092Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\XCOPY.EXE')
2018-12-17T22:49:56.460260773Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.462313299Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.467465132Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.479261178Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\DEFRAG.EXE')
2018-12-17T22:49:56.493404469Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.494629969Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.49882405Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.510645048Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\DEFRAG.HLP')
2018-12-17T22:49:56.523391157Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.524596412Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.529402726Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.540620063Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\EGA.CPI')
2018-12-17T22:49:56.552917387Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.555477876Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.564788713Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.580882429Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\EGA2.CPI')
2018-12-17T22:49:56.59506909Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.596823929Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.602681546Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.616828119Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\EGA3.CPI')
2018-12-17T22:49:56.626350522Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.628976467Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.63633961Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.648886038Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\EMM386.EXE')
2018-12-17T22:49:56.661967944Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.664269415Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.669042349Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.680942627Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\ISO.CPI')
2018-12-17T22:49:56.693970859Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.695407056Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.699819706Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.712618393Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\KEYBRD2.SYS')
2018-12-17T22:49:56.727150673Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.7287452Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.734164468Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.745958261Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\MSCDEX.EXE')
2018-12-17T22:49:56.758594643Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.76116643Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.765622931Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.777478423Z 65 PC: 148b9 | Delete file (Filename = 'C:\DOS\QBASIC.INI')
2018-12-17T22:49:56.792371545Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.794306456Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.798087011Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:49:56.800524682Z 78 PC: 13f91 | Find first file
2018-12-17T22:49:56.808130831Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.809467517Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.813842582Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.815479639Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.819160557Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.821206864Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.825322715Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:49:56.826961597Z 78 PC: 13f91 | Find first file
2018-12-17T22:49:56.838575575Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.839903065Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.843463396Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.845593093Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.85012375Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.851701993Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.856886589Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.869471777Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CONTROL.HLP')
2018-12-17T22:49:56.884958491Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.887667445Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.892736944Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.904352818Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SETUP.EXE')
2018-12-17T22:49:56.918415475Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.919845742Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.925178982Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.937216474Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SETUP.HLP')
2018-12-17T22:49:56.949940464Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.951580746Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.957000844Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:56.968628384Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SETUP.TXT')
2018-12-17T22:49:56.9816233Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:56.984657382Z 79 PC: 13fae | Find next file
2018-12-17T22:49:56.990011108Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.001663209Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM.INI')
2018-12-17T22:49:57.01576986Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.017488179Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.021948382Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.034219891Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WIN.INI')
2018-12-17T22:49:57.046535378Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.047748623Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.05327106Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.064122879Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINHELP.EXE')
2018-12-17T22:49:57.072013744Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.073654812Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.076642345Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.08339895Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WIN.COM')
2018-12-17T22:49:57.09111385Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.092269928Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.096409677Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.107773953Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\BOOTLOG.TXT')
2018-12-17T22:49:57.120568373Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.12214163Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.127784119Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.139225525Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\MOUSE.INI')
2018-12-17T22:49:57.151639142Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.153770356Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.158128812Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.169519186Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\MSD.EXE')
2018-12-17T22:49:57.184459943Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.186131444Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.190779523Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.203005601Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PACKAGER.EXE')
2018-12-17T22:49:57.21540126Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.216998126Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.222480645Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.233894727Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PBRUSH.EXE')
2018-12-17T22:49:57.248393114Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.250347652Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.254959273Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.266233433Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SOL.EXE')
2018-12-17T22:49:57.279924482Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.281112137Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.285650351Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.298771976Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\TERMINAL.EXE')
2018-12-17T22:49:57.312524094Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.314301156Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.320236161Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.331818291Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINFILE.EXE')
2018-12-17T22:49:57.346662609Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.348830959Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.35381208Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.366112114Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINFILE.HLP')
2018-12-17T22:49:57.381443537Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.38279443Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.387296586Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.400364286Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINTUTOR.EXE')
2018-12-17T22:49:57.412746321Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.41407891Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.419760223Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.431373383Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WRITE.EXE')
2018-12-17T22:49:57.446212677Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.448637072Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.452991153Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.464814873Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CALC.EXE')
2018-12-17T22:49:57.478136405Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.479935454Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.484774429Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.497881174Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CALC.HLP')
2018-12-17T22:49:57.51108981Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.512738904Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.517976222Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.529248932Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CALENDAR.EXE')
2018-12-17T22:49:57.541429192Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.543253922Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.547971752Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.560091314Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CALENDAR.HLP')
2018-12-17T22:49:57.574326923Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.576267889Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.582351777Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.59377227Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CANYON.MID')
2018-12-17T22:49:57.606778609Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.609393267Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.614387601Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.626130661Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CARDFILE.EXE')
2018-12-17T22:49:57.640577221Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.642740656Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.647614073Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.660461912Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CARDFILE.HLP')
2018-12-17T22:49:57.67332881Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.674922747Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.680227405Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.701504278Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CHARMAP.EXE')
2018-12-17T22:49:57.716140925Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.718543437Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.723611775Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.73686392Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CHORD.WAV')
2018-12-17T22:49:57.750161732Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.751481838Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.756201042Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.769613284Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CLIPBRD.EXE')
2018-12-17T22:49:57.782290615Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.783972583Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.789492636Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.80116055Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CONTROL.EXE')
2018-12-17T22:49:57.820495151Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.823245867Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.831338133Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.844298145Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CONTROL.INI')
2018-12-17T22:49:57.859619116Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.861711755Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.866835745Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.880571728Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\DRWATSON.EXE')
2018-12-17T22:49:57.895688902Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.89771945Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.904084222Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.9168259Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\EMM386.EXE')
2018-12-17T22:49:57.93024368Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.933463468Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.939131622Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.951659964Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\EXPAND.EXE')
2018-12-17T22:49:57.967409847Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:57.969460895Z 79 PC: 13fae | Find next file
2018-12-17T22:49:57.974515588Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:57.987591976Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\GLOSSARY.HLP')
2018-12-17T22:49:58.000291905Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.001943539Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.0074919Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.019274819Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\MORICONS.DLL')
2018-12-17T22:49:58.037444927Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.039862935Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.044520759Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.056793079Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\MPLAYER.EXE')
2018-12-17T22:49:58.07224465Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.073611841Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.078261036Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.091005364Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\NETWORKS.WRI')
2018-12-17T22:49:58.10313405Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.104474369Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.108820458Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.119892372Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\NOTEPAD.EXE')
2018-12-17T22:49:58.133153231Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.134467805Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.138810955Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.151860467Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PACKAGER.HLP')
2018-12-17T22:49:58.164763747Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.165952918Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.171354087Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.183105446Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PBRUSH.HLP')
2018-12-17T22:49:58.195567319Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.197727179Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.20200271Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.214663818Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PIFEDIT.EXE')
2018-12-17T22:49:58.228053622Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.229539255Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.234446628Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.246559696Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PIFEDIT.HLP')
2018-12-17T22:49:58.256622084Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.258454816Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.261890293Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.269229144Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PRINTERS.WRI')
2018-12-17T22:49:58.28421146Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.285702766Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.290098389Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.302508546Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PRINTMAN.EXE')
2018-12-17T22:49:58.316294783Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.318275126Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.322894032Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.337708036Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PRINTMAN.HLP')
2018-12-17T22:49:58.352249401Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.355598841Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.361098489Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.372762803Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PROGMAN.EXE')
2018-12-17T22:49:58.386150607Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.387857949Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.392565003Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.404388987Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PROGMAN.HLP')
2018-12-17T22:49:58.417605801Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.41874751Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.423253901Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.434772029Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\README.WRI')
2018-12-17T22:49:58.44808992Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.4500058Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.454577093Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.467020372Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\RECORDER.EXE')
2018-12-17T22:49:58.480147897Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.481270327Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.486230215Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.777995637Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\RECORDER.HLP')
2018-12-17T22:49:58.813668507Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.816062907Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.820454904Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.831956181Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\REGEDIT.EXE')
2018-12-17T22:49:58.844776491Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.845892259Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.85086226Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.862301011Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\REGEDIT.HLP')
2018-12-17T22:49:58.874733917Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.877151313Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.882122089Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.89433958Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\REGEDITV.HLP')
2018-12-17T22:49:58.907997306Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.909771719Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.914678068Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.926971123Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SMARTDRV.EXE')
2018-12-17T22:49:58.939314079Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.940909678Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.946456725Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.956719674Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SOUNDREC.EXE')
2018-12-17T22:49:58.964688665Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.966485501Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.969124661Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.976236212Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSINI.WRI')
2018-12-17T22:49:58.983591611Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:58.984570893Z 79 PC: 13fae | Find next file
2018-12-17T22:49:58.987835495Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:58.994524799Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\TERMINAL.HLP')
2018-12-17T22:49:59.002099671Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.00360454Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.00638952Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.013317989Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINHELP.HLP')
2018-12-17T22:49:59.021370564Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.022496587Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.025723292Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.032882582Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINLOGO.BMP')
2018-12-17T22:49:59.040997289Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.042712284Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.04569562Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.052516906Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINMINE.EXE')
2018-12-17T22:49:59.060731932Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.061818963Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.064576666Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.072465319Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINTUTOR.DAT')
2018-12-17T22:49:59.084309722Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.086076626Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.091696449Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.104000799Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WRITE.HLP')
2018-12-17T22:49:59.11621686Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.118588128Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.123231934Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.135383312Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\256COLOR.BMP')
2018-12-17T22:49:59.147559521Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.148931707Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.154572322Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.167347982Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\ARCADE.BMP')
2018-12-17T22:49:59.180073659Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.182480335Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.187272261Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.199236613Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\ARGYLE.BMP')
2018-12-17T22:49:59.212809403Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.214460645Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.219373704Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.232787937Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CASTLE.BMP')
2018-12-17T22:49:59.247019744Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.249346174Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.253789474Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.266806809Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CHARMAP.HLP')
2018-12-17T22:49:59.283126619Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.28449094Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.288894205Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.303172126Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CHIMES.WAV')
2018-12-17T22:49:59.316017041Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.317615628Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.322938748Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.335287944Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CLIPBRD.HLP')
2018-12-17T22:49:59.348439179Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.349814377Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.353975692Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.369812296Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\CLOCK.EXE')
2018-12-17T22:49:59.383016758Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.389499667Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.396243097Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.408368908Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\DING.WAV')
2018-12-17T22:49:59.421720809Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.424554721Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.429547633Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.444900073Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\EGYPT.BMP')
2018-12-17T22:49:59.466557618Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.468304836Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.473106396Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.486082408Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-17T22:49:59.499321918Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.500659941Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.505564611Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.515969553Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\HONEY.BMP')
2018-12-17T22:49:59.52334397Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.524662123Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.527533627Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.534987041Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\MPLAYER.HLP')
2018-12-17T22:49:59.542529184Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.543961541Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.547287127Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.5544947Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\MSD.INI')
2018-12-17T22:49:59.566645261Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.568168958Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.572357758Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.583681053Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\NOTEPAD.HLP')
2018-12-17T22:49:59.595978815Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.597030227Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.60170562Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.611837718Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PBRUSH.DLL')
2018-12-17T22:49:59.625019004Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.627653374Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.632766863Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.644218628Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\RAMDRIVE.SYS')
2018-12-17T22:49:59.652259956Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.653299603Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.656008699Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.665202145Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\RECORDER.DLL')
2018-12-17T22:49:59.67733733Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.679620384Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.684909884Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.696512139Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\REDBRICK.BMP')
2018-12-17T22:49:59.711083056Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.715759014Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.720414527Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.733608734Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\RIVETS.BMP')
2018-12-17T22:49:59.746879753Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.748631751Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.754496992Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.764972427Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SCRNSAVE.SCR')
2018-12-17T22:49:59.777615851Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.7799453Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.785058396Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.79843646Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SOL.HLP')
2018-12-17T22:49:59.812604305Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.814246083Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.820511078Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.832775656Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SOUNDREC.HLP')
2018-12-17T22:49:59.845323532Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.847222381Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.851559676Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.863706039Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SQUARES.BMP')
2018-12-17T22:49:59.873559557Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.87582546Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.879220726Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.885918748Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SSFLYWIN.SCR')
2018-12-17T22:49:59.894723497Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.8973484Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.901986179Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.914681421Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SSMARQUE.SCR')
2018-12-17T22:49:59.92959127Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.930897048Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.942489929Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.955104801Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SSSTARS.SCR')
2018-12-17T22:49:59.967639417Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:49:59.970485609Z 79 PC: 13fae | Find next file
2018-12-17T22:49:59.975289907Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:49:59.987364633Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\TASKMAN.EXE')
2018-12-17T22:49:59.999802635Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.001384568Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.006945416Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.020623318Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\THATCH.BMP')
2018-12-17T22:50:00.033202998Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.035764246Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.04031015Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.052229971Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WININI.WRI')
2018-12-17T22:50:00.065292401Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.066866683Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.072436066Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.084521926Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINMINE.HLP')
2018-12-17T22:50:00.095826091Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.09766398Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.100466662Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.107586918Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINVER.EXE')
2018-12-17T22:50:00.122081161Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.124423572Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.128778683Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.141211476Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\ZIGZAG.BMP')
2018-12-17T22:50:00.152942807Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.154971241Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.159059147Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.170069992Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\_DEFAULT.PIF')
2018-12-17T22:50:00.179193372Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.180152435Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.184946246Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.196074354Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\DOSPRMPT.PIF')
2018-12-17T22:50:00.204014403Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.205615777Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.208944089Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.210395613Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.214577349Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.225652465Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\PROGMAN.INI')
2018-12-17T22:50:00.238118284Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.239420407Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.243643341Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.255089883Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\REG.DAT')
2018-12-17T22:50:00.279439839Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.281312528Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.285842191Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.297315457Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\MAIN.GRP')
2018-12-17T22:50:00.30958395Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.310710558Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.315148949Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.327425973Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\ACCESSOR.GRP')
2018-12-17T22:50:00.339490809Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.341038133Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.345377508Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.357751499Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\GAMES.GRP')
2018-12-17T22:50:00.369955613Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.371508976Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.376313288Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.387778774Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\STARTUP.GRP')
2018-12-17T22:50:00.401249608Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.402544915Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.40678382Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.418725577Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\APPLICAT.GRP')
2018-12-17T22:50:00.431414536Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.433810947Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.438741323Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.450744838Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\QBASIC.PIF')
2018-12-17T22:50:00.464357874Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.465418804Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.470124041Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.477224646Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\EDIT.PIF')
2018-12-17T22:50:00.484660372Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.486895529Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.489624222Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.49668144Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\WINFILE.INI')
2018-12-17T22:50:00.504803838Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.505909843Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.509102531Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.516090685Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\DOSAPP.INI')
2018-12-17T22:50:00.526461955Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.527874087Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.531369421Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:00.534153972Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:00.541604505Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.542732619Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.547129701Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.548825272Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.554252728Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:00.55618622Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:00.566589288Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.56832229Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.572639685Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.574526236Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.579688694Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.590903664Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\CPWIN386.CPL')
2018-12-17T22:50:00.606808541Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.608001283Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.612563374Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.624565655Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\GDI.EXE')
2018-12-17T22:50:00.636907391Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.639336521Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.643499634Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.654742544Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SETUP.INF')
2018-12-17T22:50:00.668709941Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.670211382Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.67509062Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.68652273Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\USER.EXE')
2018-12-17T22:50:00.700058468Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.702009087Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.706955134Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.719058426Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\CGA40WOA.FON')
2018-12-17T22:50:00.732768343Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.734242247Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.739542728Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.746921611Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\CGA80WOA.FON')
2018-12-17T22:50:00.755822158Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.757028473Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.760056414Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.76841801Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COMM.DRV')
2018-12-17T22:50:00.776193831Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.777476366Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.781320101Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.790024049Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\DOSAPP.FON')
2018-12-17T22:50:00.799376623Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.800607797Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.803713246Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.811159964Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\DOSX.EXE')
2018-12-17T22:50:00.818846566Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.820716734Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.823570545Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.830466715Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\EGA40WOA.FON')
2018-12-17T22:50:00.843015657Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.844874643Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.850338566Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.861960208Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\KEYBOARD.DRV')
2018-12-17T22:50:00.870302489Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.871360725Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.87413229Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.884780109Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\KRNL286.EXE')
2018-12-17T22:50:00.892408163Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.893621326Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.89671218Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.903432284Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\KRNL386.EXE')
2018-12-17T22:50:00.916025262Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.917177401Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.921142117Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.932907454Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\LZEXPAND.DLL')
2018-12-17T22:50:00.948935573Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.951821772Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.956459389Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:00.974070629Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MOUSE.DRV')
2018-12-17T22:50:00.987454926Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:00.98897425Z 79 PC: 13fae | Find next file
2018-12-17T22:50:00.995541432Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.007004018Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VER.DLL')
2018-12-17T22:50:01.020146147Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.022430897Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.026919396Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.041130174Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VGA.3GR')
2018-12-17T22:50:01.054480579Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.057119852Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.063051444Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.07567929Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VGA.DRV')
2018-12-17T22:50:01.088483727Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.091291824Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.096104098Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.108254812Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VGACOLOR.2GR')
2018-12-17T22:50:01.121530088Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.122813897Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.127831844Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.139494197Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VGALOGO.RLE')
2018-12-17T22:50:01.15288621Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.154980927Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.159695085Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.171927471Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VGAOEM.FON')
2018-12-17T22:50:01.185169469Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.187926527Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.19307266Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.20472544Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VGASYS.FON')
2018-12-17T22:50:01.218161211Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.220209921Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.224842778Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.237163416Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WIN.CNF')
2018-12-17T22:50:01.252150829Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.254856924Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.260029296Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.272128163Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WIN87EM.DLL')
2018-12-17T22:50:01.286332973Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.287821186Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.292318225Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.304981473Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\EGA80WOA.FON')
2018-12-17T22:50:01.327689174Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.329516663Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.332638973Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.343649708Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MMSOUND.DRV')
2018-12-17T22:50:01.356184536Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.357551606Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.362611592Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.373775519Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SYSTEM.DRV')
2018-12-17T22:50:01.391665288Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.393545367Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.398097831Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.410259671Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VGAFIX.FON')
2018-12-17T22:50:01.422239724Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.424228674Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.428792575Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.440349019Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VGALOGO.LGO')
2018-12-17T22:50:01.456811597Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.458290194Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.463637141Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.47509024Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SOUND.DRV')
2018-12-17T22:50:01.487097871Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.489633768Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.494367739Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.505577062Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MAIN.CPL')
2018-12-17T22:50:01.526769323Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.530211673Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.536097306Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.547364928Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VTDA.386')
2018-12-17T22:50:01.561063217Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.562753983Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.567344081Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.580654195Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WIN386.EXE')
2018-12-17T22:50:01.59427274Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.595624342Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.601195254Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.612677954Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\APPS.INF')
2018-12-17T22:50:01.627689881Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.62927104Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.633601583Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.646701155Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COMMDLG.DLL')
2018-12-17T22:50:01.658959942Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.661512121Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.666047436Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.677312043Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\CONTROL.INF')
2018-12-17T22:50:01.690459229Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.691769943Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.696498662Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.727917506Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\DDEML.DLL')
2018-12-17T22:50:01.741841351Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.744190179Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.748824381Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.760793148Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\DRIVERS.CPL')
2018-12-17T22:50:01.773970566Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.775212621Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.7806722Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.79195559Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\DSWAP.EXE')
2018-12-17T22:50:01.805529788Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.806843205Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.81102069Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.823622444Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MCISEQ.DRV')
2018-12-17T22:50:01.837499353Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.840179497Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.845230573Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.856947033Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MCIWAVE.DRV')
2018-12-17T22:50:01.870721665Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.872543341Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.877423545Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.889571105Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MIDIMAP.DRV')
2018-12-17T22:50:01.902850555Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.905851863Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.911160973Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.923777866Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MMSYSTEM.DLL')
2018-12-17T22:50:01.936302054Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.937635981Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.950581188Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:01.974345857Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\OLECLI.DLL')
2018-12-17T22:50:01.988470841Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:01.989739435Z 79 PC: 13fae | Find next file
2018-12-17T22:50:01.994063711Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.005597842Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\OLESVR.DLL')
2018-12-17T22:50:02.018087983Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.020952661Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.025818871Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.038523695Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SHELL.DLL')
2018-12-17T22:50:02.051908522Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.053563336Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.059542968Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.070878443Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SYSEDIT.EXE')
2018-12-17T22:50:02.083549973Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.085233943Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.089793252Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.10309202Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TOOLHELP.DLL')
2018-12-17T22:50:02.115297786Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.117317233Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.121689341Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.132258821Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WINOA386.MOD')
2018-12-17T22:50:02.145681364Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.146803845Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.150290843Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.157966938Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WINOLDAP.MOD')
2018-12-17T22:50:02.166464256Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.167813776Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.170716246Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.179966655Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WSWAP.EXE')
2018-12-17T22:50:02.202652311Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.204751461Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.209406861Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.222687275Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ARIAL.FOT')
2018-12-17T22:50:02.237993355Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.239223387Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.254626863Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.285332463Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ARIAL.TTF')
2018-12-17T22:50:02.306154076Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.308385578Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.312094087Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.319827895Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ARIALBD.FOT')
2018-12-17T22:50:02.329517767Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.33257315Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.335773658Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.345155284Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ARIALBD.TTF')
2018-12-17T22:50:02.353981763Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.35511435Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.360160118Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.368526687Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ARIALBI.FOT')
2018-12-17T22:50:02.377549175Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.379385553Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.382077457Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.390542144Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ARIALBI.TTF')
2018-12-17T22:50:02.400099311Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.401436264Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.40530206Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.41425293Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ARIALI.FOT')
2018-12-17T22:50:02.425763197Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.427281803Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.431748062Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.445396563Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ARIALI.TTF')
2018-12-17T22:50:02.45906749Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.461838109Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.466332322Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.47946142Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COUR.FOT')
2018-12-17T22:50:02.492218926Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.493400071Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.498969764Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.51012962Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COUR.TTF')
2018-12-17T22:50:02.524716462Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.526733708Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.531874725Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.545704133Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COURBD.FOT')
2018-12-17T22:50:02.557921487Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.560210036Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.565447711Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.577957392Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COURBD.TTF')
2018-12-17T22:50:02.592122769Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.594210534Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.600255474Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.61335601Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COURBI.FOT')
2018-12-17T22:50:02.626084601Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.627811246Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.632545624Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.645205715Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COURBI.TTF')
2018-12-17T22:50:02.660961432Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.663290929Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.667818081Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.681076608Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COURE.FON')
2018-12-17T22:50:02.694107278Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.69539259Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.701071709Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.712747866Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COURI.FOT')
2018-12-17T22:50:02.725091147Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.733931991Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.738402532Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.75178175Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\COURI.TTF')
2018-12-17T22:50:02.764130357Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.766231154Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.772138122Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.783715724Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MIDIMAP.CFG')
2018-12-17T22:50:02.797613388Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.799607398Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.804453127Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.817402874Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MMTASK.TSK')
2018-12-17T22:50:02.829625406Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.831922191Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.836348113Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.848167068Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\MODERN.FON')
2018-12-17T22:50:02.861771983Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.863056563Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.868224987Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.87939783Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\ROMAN.FON')
2018-12-17T22:50:02.893423727Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.894913568Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.899428563Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.919153714Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SCRIPT.FON')
2018-12-17T22:50:02.931606531Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.934469066Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.939280511Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.953483026Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SERIFE.FON')
2018-12-17T22:50:02.96591822Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:02.967687462Z 79 PC: 13fae | Find next file
2018-12-17T22:50:02.973363602Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:02.985240526Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SETUP.REG')
2018-12-17T22:50:02.998988427Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.00035259Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.004985446Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.018077747Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SMALLE.FON')
2018-12-17T22:50:03.030223467Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.032575896Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.037653793Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.04968491Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SND.CPL')
2018-12-17T22:50:03.06361132Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.065241425Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.07110281Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.084068552Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SSERIFE.FON')
2018-12-17T22:50:03.099036043Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.100740108Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.10552461Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.117734457Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SYMBOL.FOT')
2018-12-17T22:50:03.129828075Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.132614616Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.137022808Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.149296155Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SYMBOL.TTF')
2018-12-17T22:50:03.162562988Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.164216487Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.169871249Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.181867312Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\SYMBOLE.FON')
2018-12-17T22:50:03.197951437Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.201651899Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.206581237Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.221133675Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMER.DRV')
2018-12-17T22:50:03.233656148Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.23544564Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.239857106Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.251771906Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMES.FOT')
2018-12-17T22:50:03.264741684Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.265918514Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.269657814Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.277152234Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMES.TTF')
2018-12-17T22:50:03.28809043Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.290239224Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.294597097Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.307069193Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMESBD.FOT')
2018-12-17T22:50:03.314874537Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.316842543Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.321300478Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.333164993Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMESBD.TTF')
2018-12-17T22:50:03.346301602Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.347350761Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.351823532Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.36306123Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMESBI.FOT')
2018-12-17T22:50:03.375640618Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.376811616Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.381524212Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.393004266Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMESBI.TTF')
2018-12-17T22:50:03.405943467Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.406970847Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.411165499Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.423121795Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMESI.FOT')
2018-12-17T22:50:03.430963947Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.432403269Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.436657142Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.448176267Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\TIMESI.TTF')
2018-12-17T22:50:03.4611599Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.463067376Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.468273769Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.480232865Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\VTDAPI.386')
2018-12-17T22:50:03.492899593Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.494222304Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.499097169Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.510629972Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WIN386.PS2')
2018-12-17T22:50:03.522917054Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.52412092Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.52951615Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.542072901Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WINGDING.FOT')
2018-12-17T22:50:03.553993655Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.556128704Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.560417941Z 67 PC: 14018 | Get or set file attributes
2018-12-17T22:50:03.571988628Z 65 PC: 148b9 | Delete file (Filename = 'C:\WINDOWS\SYSTEM\WINGDING.TTF')
2018-12-17T22:50:03.584209462Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.586208256Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.592656791Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.594321279Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.603176499Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.60502324Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.6092942Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.611474787Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.615296065Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.617754885Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.62706236Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.629123718Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.640302667Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.643042842Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.65513449Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.656522291Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.662419749Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.664921559Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.673772664Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.675504427Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.679790987Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.681032794Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.684654436Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.685970752Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.692994903Z 26 PC: 13fa9 | Set disk transfer address
2018-12-17T22:50:03.694950761Z 79 PC: 13fae | Find next file
2018-12-17T22:50:03.698536416Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.702846361Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.705376691Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.707285341Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.709995725Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.711213195Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.714337049Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.716091347Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.719456246Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.720874457Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.72452013Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.726272716Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.733585978Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.735589417Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.738028427Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.739883439Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.742468432Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.744140674Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.747484744Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.748460382Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.751537155Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.75264604Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.755403162Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.756515132Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.760272535Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.761314552Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.763888976Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.765328838Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.767847445Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.769391317Z 78 PC: 13f91 | Find first file
2018-12-17T22:50:03.771801007Z 26 PC: 13f85 | Set disk transfer address
2018-12-17T22:50:03.774015442Z 78 PC: 13f91 | Find first file