CreateFile	C:\msc\Windows\System32\	PATH NOT FOUND	Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
CreateFile	C:\msc\Windows\System32\	PATH NOT FOUND	Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
QueryOpen	E:\STATEMENTS\Demanded\MAY_2023	SUCCESS	CreationTime: 5/1/2023 11:03:36 AM, LastAccessTime: 5/15/2023 9:41:29 AM, LastWriteTime: 5/15/2023 9:41:29 AM, ChangeTime: 5/15/2023 9:41:29 AM, AllocationSize: 65,536, EndOfFile: 65,536, FileAttributes: DNCI
QueryOpen	C:\Msc\bin\tifftopdf.dll	SUCCESS	CreationTime: 5/9/2023 9:58:43 AM, LastAccessTime: 5/9/2023 9:58:43 AM, LastWriteTime: 4/18/2008 2:08:58 PM, ChangeTime: 5/15/2023 9:36:01 AM, AllocationSize: 528,384, EndOfFile: 527,872, FileAttributes: ANCI
CreateFile	C:\Msc\bin\tifftopdf.dll	SUCCESS	Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
QuerySecurityFile	C:\Msc\bin\tifftopdf.dll	SUCCESS	Information: Attribute
CreateFileMapping	C:\Msc\bin\tifftopdf.dll	FILE LOCKED WITH ONLY READERS	SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE
CreateFileMapping	C:\Msc\bin\tifftopdf.dll	SUCCESS	SyncType: SyncTypeOther
Load Image	C:\Msc\bin\tifftopdf.dll	SUCCESS	Image Base: 0x10000000, Image Size: 0x14c000
CloseFile	C:\Msc\bin\tifftopdf.dll	SUCCESS	
CreateFile	C:\Msc\bin\tifftopdf.dll	SUCCESS	Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened
QuerySecurityFile	C:\Msc\bin\tifftopdf.dll	SUCCESS	Information: Attribute
CreateFileMapping	C:\Msc\bin\tifftopdf.dll	FILE LOCKED WITH ONLY READERS	SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE
QueryStandardInformationFile	C:\Msc\bin\tifftopdf.dll	SUCCESS	AllocationSize: 528,384, EndOfFile: 527,872, NumberOfLinks: 1, DeletePending: False, Directory: False
CreateFileMapping	C:\Msc\bin\tifftopdf.dll	SUCCESS	SyncType: SyncTypeOther
CloseFile	C:\Msc\bin\tifftopdf.dll	SUCCESS	
QueryNameInformationFile	C:\Msc\bin\tifftopdf.dll	SUCCESS	Name: \Msc\bin\tifftopdf.dll
CreateFile	E:\STATEMENTS\Demanded\MAY_2023\Statement_demand_200405531_05-15-2023_1684169148.pdf	SUCCESS	Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Created
QuerySecurityFile	E:\STATEMENTS\Demanded\MAY_2023\Statement_demand_200405531_05-15-2023_1684169148.pdf	SUCCESS	Information: Attribute
WriteFile	E:\STATEMENTS\Demanded\MAY_2023\Statement_demand_200405531_05-15-2023_1684169148.pdf	SUCCESS	Offset: 0, Length: 2,964, Priority: Normal
CloseFile	E:\STATEMENTS\Demanded\MAY_2023\Statement_demand_200405531_05-15-2023_1684169148.pdf	SUCCESS	
CreateFile	C:\msc\Windows\System32\	PATH NOT FOUND	Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
CreateFile	C:\msc\Windows\System32\	PATH NOT FOUND	Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
CreateFile	C:\msc\Windows\System32\	PATH NOT FOUND	Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
CreateFile	C:\msc\Windows\System32\	PATH NOT FOUND	Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
QueryOpen	C:\msc\%C:\Windows\system32\drivers\fwpkclnt.sys	NAME INVALID