13:39:12,4614959 SexyCity.exe 564 Process Start SUCCESS Parent PID: 548 13:39:12,4614973 SexyCity.exe 564 Thread Create SUCCESS Thread ID: 3900 13:39:12,4701774 SexyCity.exe 564 QueryNameInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Name: \Program Files\Sexy City\2.0.0\SexyCity.exe 13:39:12,4702149 SexyCity.exe 564 QueryNameInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe BUFFER OVERFLOW Name: \P 13:39:12,4702275 SexyCity.exe 564 QueryNameInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Name: \Program Files\Sexy City\2.0.0\SexyCity.exe 13:39:12,4704470 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shell32.dll SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,4705600 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\shell32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,4706736 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shell32.dll SUCCESS 13:39:12,4708654 SexyCity.exe 564 Load Image C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Image Base: 0x400000, Image Size: 0x208000 13:39:12,4709793 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,4710322 SexyCity.exe 564 FileSystemControl C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,4710879 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS 13:39:12,4712125 SexyCity.exe 564 Load Image C:\WINDOWS\system32\ntdll.dll SUCCESS Image Base: 0x7c910000, Image Size: 0xb7000 13:39:12,4712246 SexyCity.exe 564 QueryNameInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Name: \Program Files\Sexy City\2.0.0\SexyCity.exe 13:39:12,4713810 SexyCity.exe 564 CreateFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,4714976 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS AllocationSize: 73 728, EndOfFile: 70 292, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,4715694 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,4716678 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS CreationTime: 15/02/2011 09:01:06, LastAccessTime: 17/02/2011 11:07:54, LastWriteTime: 17/02/2011 11:07:54, ChangeTime: 17/02/2011 11:07:54, FileAttributes: ANCI 13:39:12,4721019 SexyCity.exe 564 ReadFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS Offset: 0, Length: 1 024 13:39:12,4721212 SexyCity.exe 564 ReadFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:12,4857159 SexyCity.exe 564 CloseFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS 13:39:12,4961560 SexyCity.exe 564 CreateFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened 13:39:12,4962684 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS AllocationSize: 73 728, EndOfFile: 70 292, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,4963751 SexyCity.exe 564 ReadFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS Offset: 0, Length: 70 292 13:39:12,4964583 SexyCity.exe 564 ReadFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS Offset: 69 632, Length: 660, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:12,4966464 SexyCity.exe 564 CloseFile C:\WINDOWS\Prefetch\SEXYCITY.EXE-02E2B628.pf SUCCESS 13:39:12,4967499 SexyCity.exe 564 CreateFile C: SUCCESS Desired Access: Read Attributes, Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,4967882 SexyCity.exe 564 QueryInformationVolume C: BUFFER OVERFLOW VolumeCreationTime: 09/06/2007 11:31:13, VolumeSerialNumber: 0850-08A8, SupportsObjects: True, VolumeLabel: Win 13:39:12,4968241 SexyCity.exe 564 CreateFile E: SUCCESS Desired Access: Read Attributes, Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,4968470 SexyCity.exe 564 QueryInformationVolume E: BUFFER OVERFLOW VolumeCreationTime: 11/06/2007 15:27:29, VolumeSerialNumber: B41F-8669, SupportsObjects: True, VolumeLabel: Dow. 13:39:12,4968601 SexyCity.exe 564 FileSystemControl C: SUCCESS Control: FSCTL_FILE_PREFETCH 13:39:12,5252959 SexyCity.exe 564 CreateFile C:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5253279 SexyCity.exe 564 QueryDirectory C:\ SUCCESS 0: AUTOEXEC.BAT, 1: AV_LOGS, 2: boot.ini, 3: Bootfont.bin, 4: cf7099982e6a9444a3af9675e0abd9fc, 5: cleannavi.txt, 6: CMLoader.log, 7: Config.Msi, 8: CONFIG.SYS, 9: CSWARE, 10: DANCED, 11: Desperate.Housewives.s05e02.vostfr.FRoggy.srt, 12: Diaporama, 13: Documents and Settings, 14: Downloads, 15: DriveKey, 16: drmHeader.bin, 17: ICU.nfo, 18: IO.SYS, 19: iTunesRegistry.dll, 20: LAN.log, 21: Manual-PCProgram, 22: MediaOut, 23: MOULIN_ROUGE, 24: MSDOS.SYS, 25: My Downloads, 26: NeverwinterNights, 27: NTDETECT.COM, 28: ntldr, 29: NVIDIA, 30: pagefile.sys, 31: Program Files, 32: RECYCLER, 33: sqmdata00.sqm, 34: sqmdata01.sqm, 35: sqmdata02.sqm, 36: sqmdata03.sqm, 37: sqmdata04.sqm, 38: sqmdata05.sqm, 39: sqmdata06.sqm, 40: sqmdata07.sqm, 41: sqmdata08.sqm, 42: sqmdata09.sqm, 43: sqmdata10.sqm, 44: sqmdata11.sqm, 45: sqmdata12.sqm, 46: sqmdata13.sqm, 47: sqmdata14.sqm, 48: sqmdata15.sqm, 49: sqmdata16.sqm, 50: sqmdata17.sqm, 51: sqmdata18.sqm, 52: sqmdata19.sqm, 53: sqmnoopt00.sqm, 54: sqmnoopt01.sqm, 55: sqmnoopt02.sqm, 56: sqmnoopt03.sqm, 57: sqmnoopt04.sqm, 58: sqmnoopt05.sqm, 59: sqmnoopt06.sqm, 60: sqmnoopt07.sqm, 61: sqmnoopt08.sqm, 62: sqmnoopt09.sqm, 63: sqmnoopt10.sqm, 64: sqmnoopt11.sqm, 65: sqmnoopt12.sqm, 66: sqmnoopt13.sqm, 67: sqmnoopt14.sqm, 68: sqmnoopt15.sqm, 69: sqmnoopt16.sqm, 70: sqmnoopt17.sqm, 71: sqmnoopt18.sqm, 72: sqmnoopt19.sqm, 73: srcds, 74: System Volume Information, 75: TELL ME MORE CJ, 76: TELL ME MORE NV, 77: temp, 78: The.Dark.Knight.DvDrip.aXXo.srt, 79: updat.txt, 80: Users, 81: vcs5BGEffects, 82: vcs5core, 83: wifi.log, 84: WINDOWS, 85: YServer.txt 13:39:12,5254506 SexyCity.exe 564 QueryDirectory C:\ NO MORE FILES 13:39:12,5254858 SexyCity.exe 564 CloseFile C:\ SUCCESS 13:39:12,5255600 SexyCity.exe 564 CreateFile C:\DOCUMENTS AND SETTINGS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5255849 SexyCity.exe 564 QueryDirectory C:\Documents and Settings SUCCESS 0: ., 1: .., 2: Administrateur, 3: All Users, 4: DAMIEN, 5: Default User, 6: LocalService, 7: NetworkService 13:39:12,5256275 SexyCity.exe 564 QueryDirectory C:\Documents and Settings NO MORE FILES 13:39:12,5256465 SexyCity.exe 564 CloseFile C:\Documents and Settings SUCCESS 13:39:12,5257346 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5257895 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN SUCCESS 0: ., 1: .., 2: .gimp-2.4, 3: .homeplayer, 4: .recently-used.xbel, 5: .thumbnails, 6: Amy's_Fantasys, 7: Application Data, 8: Bureau, 9: Contacts, 10: Cookies, 11: default.pls, 12: errorlog.tmp, 13: Favoris, 14: gloria(rip), 15: juin.2009.0onca7m.zip, 16: juin.2009.1e4l9n7.zip, 17: juin.2009.1e4l9n7.zip.tmp, 18: juin.2009.1qz5bhr.zip, 19: juin.2009.3u4wo14.zip, 20: juin.2009.850e8og.zip.tmp, 21: juin.2009.a199hzp.zip.cpt, 22: juin.2009.bfj9qa0.zip, 23: juin.2009.bfj9qa0.zip.tmp, 24: juin.2009.c3igz38.zip, 25: juin.2009.gf1ulct.zip, 26: juin.2009.h4q36g1.zip, 27: juin.2009.jswcd0x.zip, 28: juin.2009.k75ouvh.zip, 29: juin.2009.kmfv25x.zip, 30: juin.2009.nfflpox.zip, 31: juin.2009.o3elxcp.zip, 32: juin.2009.o3elxcp.zip.tmp, 33: juin.2009.sefobcy.zip, 34: juin.2009.t05o0zp.zip, 35: juin.2009.t05o0zp.zip.tmp, 36: juin.2009.x4cs3wj.zip, 37: juin.2009.x6ro2eb.zip, 38: juin.2009.ymhiceg.zip, 39: Livestation, 40: Local Settings, 41: LocalLow, 42: Menu Demarrer, 43: Menu Démarrer, 44: Mes documents, 45: Modèles, 46: ntuser.dat, 47: ntuser.dat.LOG, 48: ntuser.ini, 49: Recent, 50: SendTo, 51: SI.bin, 52: temp1.5, 53: Tracing, 54: UserData, 55: Voisinage d'impression, 56: Voisinage réseau, 57: WINDOWS 13:39:12,5259005 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN NO MORE FILES 13:39:12,5259615 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN SUCCESS 13:39:12,5260504 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\APPLICATION DATA SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5261044 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Application Data SUCCESS 0: ., 1: .., 2: AccurateRip, 3: Activision, 4: Adobe, 5: Adobe Mini Bridge CS5, 6: AdobeUM, 7: Ahead, 8: AnvSoft, 9: Apple Computer, 10: ArcSoft, 11: AVS4YOU, 12: Azureus, 13: BitComet, 14: BitTorrent, 15: BSplayer Pro, 16: CometNetwork, 17: coreavc.ini, 18: CyberLink, 19: DarkBls, 20: DataCast, 21: desktop.ini, 22: DivX, 23: dvdcss, 24: EoRezo, 25: EPSON, 26: ezplay.cat, 27: ezplay.inf, 28: ezplay.ini, 29: ezplay.log, 30: ezplay.sys, 31: Facebook, 32: FogelSoft, 33: foobar2000, 34: Free Download Manager, 35: Google, 36: gPhotoShow, 37: Grisoft, 38: gtk-2.0, 39: Hamachi, 40: Help, 41: Hide IP NG, 42: Identities, 43: inst.exe, 44: InstallShield, 45: Leadertech, 46: Livestation, 47: LucasArts, 48: Macromedia, 49: Malwarebytes, 50: Media Player Classic, 51: MegauploadToolbar, 52: Micro Application, 53: Microsoft, 54: Microsoft Web Folders, 55: mixi, 56: mkvtoolnix, 57: Money Manager Ex, 58: Mozilla, 59: Mp3tag, 60: OpenOffice.org2, 61: Opera, 62: Orbit, 63: PCFix, 64: pcouffin.cat, 65: pcouffin.inf, 66: pcouffin.log, 67: pcouffin.sys, 68: Pegasys Inc, 69: PhotoScape, 70: PIFreePC, 71: PnkBstrK.sys, 72: PPLiveVA, 73: ppstream, 74: Radios Media Player, 75: Real, 76: Real Desktop, 77: Red Kawa, 78: RegClean, 79: Resync, 80: Samsung, 81: ScreenShow, 82: SecondLife, 83: SecuROM, 84: Skype, 85: skypePM, 86: Sony, 87: Sony Setup, 88: SPORE, 89: StageManager.BD092818F67280F4B42B04877600987F0111B594.1, 90: Sun, 91: Talkback, 92: TigerPlayer, 93: Todae, 94: TVU Networks, 95: uTorrent, 96: ViquaSoft, 97: vlc, 98: vlc(2), 99: Vso, 100: Wallpaper, 101: WinRAR, 102: Xilisoft Corporation, 103: Youtube Downloader HD 13:39:12,5262202 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Application Data NO MORE FILES 13:39:12,5262665 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Application Data SUCCESS 13:39:12,5263637 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\MICROSOFT SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5264164 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Application Data\Microsoft SUCCESS 0: ., 1: .., 2: Address Book, 3: Clip Organizer, 4: CLR Security Config, 5: Credentials, 6: CryptnetUrlCache, 7: Crypto, 8: Excel, 9: Fable, 10: Forms, 11: HTML Help, 12: IdentityCRL, 13: IMJP8_1, 14: Installer, 15: Internet Explorer, 16: Macros complémentaires, 17: Media Catalog, 18: Media Player, 19: MMC, 20: Modèles, 21: MSDN, 22: MSN Messenger, 23: MSNLiveFav, 24: Office, 25: OIS, 26: Outlook, 27: PowerPoint, 28: Protect, 29: Publisher, 30: Speech, 31: SystemCertificates, 32: VCExpress, 33: Windows, 34: Windows Live, 35: Windows Live Call, 36: Windows Live Photo Gallery, 37: Windows Messenger, 38: Word, 39: Épreuve 13:39:12,5265065 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Application Data\Microsoft NO MORE FILES 13:39:12,5265531 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft SUCCESS 13:39:12,5266374 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR SECURITY CONFIG SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5267297 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config SUCCESS 0: ., 1: .., 2: v1.1.4322, 3: v2.0.50727.42 13:39:12,5267928 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config NO MORE FILES 13:39:12,5268395 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config SUCCESS 13:39:12,5269719 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\V2.0.50727.42 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5270628 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42 SUCCESS 0: ., 1: .., 2: security.config.cch 13:39:12,5271448 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42 NO MORE FILES 13:39:12,5272059 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42 SUCCESS 13:39:12,5273221 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\LOCAL SETTINGS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5273748 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Local Settings SUCCESS 0: ., 1: .., 2: Application Data, 3: Apps, 4: desktop.ini, 5: Historique, 6: Temp, 7: Temporary Internet Files 13:39:12,5274589 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Local Settings NO MORE FILES 13:39:12,5275051 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Local Settings SUCCESS 13:39:12,5275890 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Local Settings\APPLICATION DATA SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5276410 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Local Settings\Application Data SUCCESS 0: ., 1: .., 2: ABBYY, 3: Activision, 4: Adobe, 5: Ahead, 6: AKSoftware, 7: Apple, 8: Apple Computer, 9: ApplicationHistory, 10: ArcSoft, 11: AVNEX_Ltd._(CY), 12: CAPCOM, 13: CometNetwork, 14: Conduit, 15: ConduitEngine, 16: Cooliris, 17: DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini, 18: DOSBox, 19: Downloaded Installations, 20: Eazel-FR, 21: Fallout3, 22: fusioncache.dat, 23: GDIPFONTCACHEV1.DAT, 24: GHOSTBUSTERS (tm), 25: Google, 26: Help, 27: IconCache.db, 28: Identities, 29: Match The Note, 30: MediaMonkey, 31: Microsoft, 32: Microsoft Help, 33: monAlbumPhoto, 34: Mozilla, 35: Opera, 36: Panic Button, 37: RapidShare_, 38: RealAquarium, 39: SKIDROW, 40: Sony, 41: SRS Labs, 42: Steam, 43: Sudoku-X, 44: Temp, 45: Tom's_Guide_France, 46: TVU Networks, 47: VirtualStore, 48: Vuze_Remote, 49: Winamp Toolbar, 50: WinAVI, 51: WMTools Downloaded Files, 52: YouTube Player 13:39:12,5277275 SexyCity.exe 564 QueryDirectory C:\Documents and Settings\DAMIEN\Local Settings\Application Data NO MORE FILES 13:39:12,5277737 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data SUCCESS 13:39:12,5278296 SexyCity.exe 564 CreateFile C:\PROGRAM FILES SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5278511 SexyCity.exe 564 QueryDirectory C:\Program Files SUCCESS 0: ., 1: .., 2: 1964, 3: 7-Zip, 4: a-squared Anti-Malware, 5: ABBYY FineReader 6.0 Sprint, 6: Actives Softwares, 7: Activision, 8: Adobe, 9: Adobe Media Player, 10: adslTV, 11: Advanced Karaoke Player, 12: AGEIA Technologies, 13: Ahead, 14: AKSoftware, 15: Alawar, 16: Alcohol Soft, 17: Alwil Software, 18: AMD, 19: Analog Devices, 20: Antbar, 21: Anuman Interactive, 22: AnvSoft, 23: Anyplace Control 4, 24: Apowersoft, 25: Apple Software Update, 26: ArcSoft, 27: ASUS, 28: Atari, 29: Audacity, 30: AVIConverter, 31: AviSynth 2.5, 32: AVS4YOU, 33: Azureus, 34: BitComet, 35: BitTorrent, 36: BmGDFBinary.dll, 37: BmStartApp.exe, 38: Boilsoft Video Joiner, 39: Bonjour, 40: CamStudio, 41: CCleaner, 42: Ccrypt For TT, 43: CDisplay, 44: CometBird, 45: Common Files, 46: ComPlus Applications, 47: Conduit, 48: ConduitEngine, 49: CoreCodec, 50: Cyanide, 51: Cyberlink, 52: directx, 53: DivX, 54: DomPlayer, 55: DOSBox-0.73, 56: DVD Decrypter, 57: DVD Shrink, 58: EA Games, 59: EA SPORTS, 60: Eazel-FR, 61: eDonkey Accelerator, 62: Eidos, 63: Electronic Arts, 64: eMule, 65: EoRezo, 66: epson, 67: facemoods.com, 68: Fake Webcam, 69: FDRLab, 70: ffdsvsetts.reg, 71: Fichiers communs, 72: Flash Dating, 73: FLV PlayerFCSetup.exe, 74: foobar2000, 75: FORTUNE, 76: Free, 77: Free Audio Pack, 78: Free Download Manager, 79: FreeBrowser, 80: FreshDevices, 81: Frets on Fire, 82: Gabest, 83: GIMP-2.0, 84: Google, 85: Gordian Knot, 86: gPhotoShow, 87: Grisoft, 88: Hamachi, 89: Hercules, 90: HomePlayer, 91: Illustrate, 92: InstallShield Installation Information, 93: Internet Explorer, 94: iPod, 95: iTunes, 96: iTunes.dll, 97: IVCsoft, 98: iWare, 99: Java, 100: JDownloader, 101: Jellyfish, 102: Jeu_Oie, 103: JlgSolera, 104: K Media Center, 105: K-Lite Codec Pack, 106: KaraFun, 107: KeyHoleTV, 108: L'Aventure Multimedia, 109: LED, 110: LucasArts, 111: MagicISO, 112: Malwarebytes' Anti-Malware, 113: MarkAny, 114: Matroska Pack, 115: MediaCoder, 116: MediaKey, 117: MediaMonkey, 118: Messenger, 119: Messenger Plus! Live, 120: Micro Application, 121: Microsoft, 122: microsoft frontpage, 123: Microsoft Games for Windows - LIVE, 124: Microsoft Office, 125: Microsoft Office Outlook Connector, 126: Microsoft Research, 127: Microsoft SDKs, 128: Microsoft Silverlight, 129: Microsoft SQL Server Compact Edition, 130: Microsoft Sync Framework, 131: Microsoft Visual Studio, 132: Microsoft Visual Studio 9.0, 133: Microsoft Works, 134: Microsoft.NET, 135: mixi station, 136: MKVtoolnix, 137: monAlbumPhoto, 138: Movie Maker, 139: Mozilla Firefox, 140: Mozilla Firefox 3 Beta 2, 141: Mp3tag, 142: MPC HomeCinema, 143: MpcStar, 144: MSBuild, 145: MSBuild(2), 146: MSECACHE, 147: MSN, 148: MSN Gaming Zone, 149: MSN Messenger, 150: MSN Reaper, 151: MSXML 4.0, 152: MSXML 6.0, 153: Navilog1, 154: NetMeeting, 155: Neurosys, 156: NVIDIA Corporation, 157: Odebit Multimédia, 158: Online Services, 159: OpenAL, 160: OpenOffice.org 2.4, 161: Opera, 162: Outlook Express, 163: Panda Security, 164: PapierPeint, 165: PC Inspector File Recovery, 166: PCFix, 167: Pegasys Inc, 168: PENDULO Studios, 169: Photo Story 3 for Windows, 170: PhotoFiltre, 171: PhotoFiltre Studio, 172: PhotoScape, 173: PicturesToExe, 174: PMPro PSP Video Converter, 175: PowerISO, 176: PowerQuest, 177: PPLive, 178: PPLiveVA, 179: PPStream, 180: Project64 1.6, 181: QuickTime, 182: RADVideo, 183: ReadPlease 2003, 184: Real, 185: Realtek, 186: Red Kawa, 187: Reference Assemblies, 188: RegClean, 189: RegCleaner, 190: RocketDock, 191: RS P2P Share Spy Demo, 192: Samsung, 193: Satsuki Decoder Pack, 194: Secret Of Monkey Island SE, 195: Services en ligne, 196: Sexy City, 197: Sexy City(2), 198: SHARE 1.0 EX2, 199: SHOE, 200: Skype, 201: SlySoft, 202: SmartSound Software, 203: Sony, 204: Sony Ericsson, 205: Sony Setup, 206: SopCast, 207: Soulseek, 208: Soulseek-Test, 209: Spybot - Search & Destroy, 210: SSC Service Utility, 211: Stardock, 212: steam, 213: Stratabase, 214: StuffPlug3, 215: Super DX-Ball Deluxe, 216: Telltale Games, 217: TFM, 218: THQ, 219: TimeAdjuster, 220: Tom's_Guide_France, 221: ToniArts, 222: Total War, 223: TVAnts, 224: TVUPlayer, 225: Ubisoft, 226: UltraISO, 227: Uninstall Information, 228: URUSoft, 229: uTorrent, 230: Valve, 231: Vampire The Masquerade - Redemption, 232: VIA, 233: viCompte, 234: VideoLAN, 235: VirtualDub, 236: VirtualDubMOD, 237: VSO, 238: Vuze, 239: Vuze_Remote, 240: Webteh, 241: Winamp Toolbar, 242: Windows Installer Clean Up, 243: Windows Live, 244: Windows Live SkyDrive, 245: Windows Live Toolbar, 246: Windows Media Connect 2, 247: Windows Media Player, 248: Windows NT, 249: WindowsUpdate, 250: WinLemm, 251: WinRAR, 252: xerox, 253: Xilisoft, 254: Yahoo!, 255: YouTUBE (TM) movie downloader, 256: Youtube Downloader HD, 257: ZX-Playback-Pack 13:39:12,5279982 SexyCity.exe 564 QueryDirectory C:\Program Files NO MORE FILES 13:39:12,5280172 SexyCity.exe 564 CloseFile C:\Program Files SUCCESS 13:39:12,5280735 SexyCity.exe 564 CreateFile C:\Program Files\FICHIERS COMMUNS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5280966 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs SUCCESS 0: ., 1: .., 2: Adobe, 3: Adobe AIR, 4: Ahead, 5: Apple, 6: ArcSoft, 7: AVSMedia, 8: Bcgsoft, 9: Canon, 10: DESIGNER, 11: EZB Systems, 12: fwc, 13: InstallShield, 14: Java, 15: Merge Modules, 16: Microsoft Shared, 17: MSSoap, 18: Nero, 19: NSV, 20: ODBC, 21: Real, 22: Services, 23: Skype, 24: Sony Shared, 25: SpeechEngines, 26: System, 27: Thraex Software, 28: Windows Live, 29: WindowsLiveInstaller, 30: Wise Installation Wizard 13:39:12,5281467 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs NO MORE FILES 13:39:12,5281744 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs SUCCESS 13:39:12,5282495 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\MICROSOFT SHARED SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5282783 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\Microsoft Shared SUCCESS 0: ., 1: .., 2: DAO, 3: Database Replication, 4: DevHelp, 5: DW, 6: EQUATION, 7: EURO, 8: GRPHFLT, 9: Help, 10: Help 9, 11: MODI, 12: MSClientDataMgr, 13: MSDesigners7, 14: MSDesigners8, 15: MSENV, 16: MSI Tools, 17: MSInfo, 18: MSORUN, 19: OFFICE11, 20: OFFICE12, 21: OFFICE12(2), 22: Papier à lettres, 23: Portal, 24: PROOF, 25: Reference Titles, 26: Smart Tag, 27: Snapshot Viewer, 28: Source Engine, 29: Speech, 30: SpeechEngines, 31: TextConv, 32: THEMES11, 33: TRANSLAT, 34: Triedit, 35: VBA, 36: VC, 37: VGX, 38: Visual Database Tools, 39: VS Help Data, 40: VS7DEBUG, 41: Web Components, 42: Web Folders, 43: web server extensions, 44: Windows Live 13:39:12,5283438 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\Microsoft Shared NO MORE FILES 13:39:12,5283641 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs\Microsoft Shared SUCCESS 13:39:12,5284311 SexyCity.exe 564 CreateFile C:\Program Files\SEXY CITY SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5284544 SexyCity.exe 564 QueryDirectory C:\Program Files\Sexy City SUCCESS 0: ., 1: .., 2: 1.3.1, 3: 2.0.0 13:39:12,5285035 SexyCity.exe 564 QueryDirectory C:\Program Files\Sexy City NO MORE FILES 13:39:12,5285313 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City SUCCESS 13:39:12,5285885 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5286108 SexyCity.exe 564 QueryDirectory C:\Program Files\Sexy City\2.0.0 SUCCESS 0: ., 1: .., 2: ClassesSexyCity.dll, 3: DirectX.Capture.dll, 4: DShowNET.dll, 5: Editeur.exe, 6: notice, 7: options, 8: SexyCity.exe, 9: unins000.dat, 10: unins000.exe 13:39:12,5286468 SexyCity.exe 564 QueryDirectory C:\Program Files\Sexy City\2.0.0 NO MORE FILES 13:39:12,5286657 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0 SUCCESS 13:39:12,5287493 SexyCity.exe 564 CreateFile C:\WINDOWS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5287982 SexyCity.exe 564 QueryDirectory C:\WINDOWS SUCCESS 0: ., 1: .., 2: $hf_mig$, 3: $MSI31Uninstall_KB893803v2$, 4: $NtServicePackUninstallIDNMitigationAPIs$, 5: $NtServicePackUninstallNLSDownlevelMapping$, 6: $NtUninstallbasecsp$, 7: $NtUninstallKB873339$, 8: $NtUninstallKB885835$, 9: $NtUninstallKB885836$, 10: $NtUninstallKB886185$, 11: $NtUninstallKB887472$, 12: $NtUninstallKB888111WXPSP2$, 13: $NtUninstallKB888302$, 14: $NtUninstallKB890046$, 15: $NtUninstallKB890859$, 16: $NtUninstallKB891122$, 17: $NtUninstallKB891781$, 18: $NtUninstallKB893756$, 19: $NtUninstallKB894391$, 20: $NtUninstallKB896358$, 21: $NtUninstallKB896423$, 22: $NtUninstallKB896428$, 23: $NtUninstallKB898461$, 24: $NtUninstallKB899587$, 25: $NtUninstallKB899591$, 26: $NtUninstallKB900485$, 27: $NtUninstallKB900725$, 28: $NtUninstallKB901017$, 29: $NtUninstallKB901190$, 30: $NtUninstallKB901214$, 31: $NtUninstallKB902400$, 32: $NtUninstallKB904706$, 33: $NtUninstallKB904942$, 34: $NtUninstallKB905414$, 35: $NtUninstallKB905749$, 36: $NtUninstallKB908519$, 37: $NtUninstallKB908531$, 38: $NtUninstallKB910437$, 39: $NtUninstallKB911280$, 40: $NtUninstallKB911562$, 41: $NtUninstallKB911564$, 42: $NtUninstallKB911927$, 43: $NtUninstallKB913580$, 44: $NtUninstallKB914388$, 45: $NtUninstallKB914389$, 46: $NtUninstallKB914440$, 47: $NtUninstallKB915865$, 48: $NtUninstallKB916595$, 49: $NtUninstallKB917344$, 50: $NtUninstallKB917422$, 51: $NtUninstallKB917734_WMP9$, 52: $NtUninstallKB917953$, 53: $NtUninstallKB918118$, 54: $NtUninstallKB918439$, 55: $NtUninstallKB919007$, 56: $NtUninstallKB920213$, 57: $NtUninstallKB920342$, 58: $NtUninstallKB920670$, 59: $NtUninstallKB920683$, 60: $NtUninstallKB920685$, 61: $NtUninstallKB920872$, 62: $NtUninstallKB921503$, 63: $NtUninstallKB922582$, 64: $NtUninstallKB922819$, 65: $NtUninstallKB923191$, 66: $NtUninstallKB923414$, 67: $NtUninstallKB923689$, 68: $NtUninstallKB923694$, 69: $NtUninstallKB923980$, 70: $NtUninstallKB924191$, 71: $NtUninstallKB924270$, 72: $NtUninstallKB924496$, 73: $NtUninstallKB924667$, 74: $NtUninstallKB925398_WMP64$, 75: $NtUninstallKB925720$, 76: $NtUninstallKB925876$, 77: $NtUninstallKB925902$, 78: $NtUninstallKB926239$, 79: $NtUninstallKB926255$, 80: $NtUninstallKB926436$, 81: $NtUninstallKB927779$, 82: $NtUninstallKB927802$, 83: $NtUninstallKB927891$, 84: $NtUninstallKB928255$, 85: $NtUninstallKB928843$, 86: $NtUninstallKB929123$, 87: $NtUninstallKB929399$, 88: $NtUninstallKB929969$, 89: $NtUninstallKB930178$, 90: $NtUninstallKB930916$, 91: $NtUninstallKB931261$, 92: $NtUninstallKB931768$, 93: $NtUninstallKB931784$, 94: $NtUninstallKB931836$, 95: $NtUninstallKB932168$, 96: $NtUninstallKB932823-v3$, 97: $NtUninstallKB933360$, 98: $NtUninstallKB933729$, 99: $NtUninstallKB935839$, 100: $NtUninstallKB935840$, 101: $NtUninstallKB936021$, 102: $NtUninstallKB936357$, 103: $NtUninstallKB936782_WMP10$, 104: $NtUninstallKB936782_WMP11$, 105: $NtUninstallKB936782_WMP9$, 106: $NtUninstallKB938464$, 107: $NtUninstallKB938828$, 108: $NtUninstallKB938829$, 109: $NtUninstallKB939683$, 110: $NtUninstallKB941202$, 111: $NtUninstallKB941568$, 112: $NtUninstallKB941569$, 113: $NtUninstallKB941644$, 114: $NtUninstallKB941693$, 115: $NtUninstallKB942288-v3$, 116: $NtUninstallKB942763$, 117: $NtUninstallKB943055$, 118: $NtUninstallKB943460$, 119: $NtUninstallKB943485$, 120: $NtUninstallKB944653$, 121: $NtUninstallKB945553$, 122: $NtUninstallKB946026$, 123: $NtUninstallKB946648$, 124: $NtUninstallKB948590$, 125: $NtUninstallKB948881$, 126: $NtUninstallKB950749$, 127: $NtUninstallKB950760$, 128: $NtUninstallKB950762$, 129: $NtUninstallKB950974$, 130: $NtUninstallKB951066$, 131: $NtUninstallKB951072-v2$, 132: $NtUninstallKB951376$, 133: $NtUninstallKB951376-v2$, 134: $NtUninstallKB951698$, 135: $NtUninstallKB951748$, 136: $NtUninstallKB952011$, 137: $NtUninstallKB952287$, 138: $NtUninstallKB952954$, 139: $NtUninstallKB953839$, 140: $NtUninstallKB954154_WM11$, 141: $NtUninstallKB954211$, 142: $NtUninstallKB956391$, 143: $NtUninstallKB956803$, 144: $NtUninstallKB956841$, 145: $NtUninstallKB957095$, 146: $NtUninstallKB958644$, 147: $NtUninstallWIC$, 148: $NtUninstallWMFDist11$, 149: $NtUninstallwmp11$, 150: $NtUninstallWudf01000$, 151: $NtUninstallXPSEPSCLP$, 152: 0.log, 153: 6833245EDD86479A882A8360D62C8194.TMP, 154: Active WallPaper.bmp, 155: addins, 156: Applian FLV Player, 157: AppPatch, 158: Ascd_log.ini, 159: Ascd_tmp.ini, 160: assembly, 161: ASUSInstAll, 162: AS_Debug.txt, 163: avastSS.scr, 164: avisplitter.ini, 165: AxInterop.SHDocVw.dll, 166: BM0b633b9b.txt, 167: BM0b633b9b.xml, 168: bootstat.dat, 169: BricoPack Wallpaper.bmp, 170: BricoPackFoldersDelete.cmd, 171: BricoPacks, 172: BricoPackUninst.cmd, 173: BricoPackUninst.txt, 174: Bulles de savon.bmp, 175: Cache, 176: CDE DX7400DEFGIPS.ini, 177: cdplayer.ini, 178: clock.avi, 179: cmc2007.ini, 180: COM+.log, 181: comsetup.log, 182: Config, 183: Connection Wizard, 184: control.ini, 185: Cursors, 186: d3dx.dat, 187: Debug, 188: DEBUGSM.INI, 189: delttsul.exe, 190: Downloaded Installations, 191: Downloaded Program Files, 192: Driver Cache, 193: dwin4139.dat, 194: DXT1D3.tmp, 195: DXT1D4.tmp, 196: DXT1D5.tmp, 197: DXT1D6.tmp, 198: err.txt, 199: eSellerateEngine.dll, 200: explorer.exe, 201: explorer.scf, 202: FaxSetup.log, 203: FISHUI.INI, 204: Flash Dating, 205: Fonts, 206: Freecorder Toolbar, 207: ftpcache, 208: game.ini, 209: GPS 2009 FRANCE Uninstaller.exe, 210: Granit vert.bmp, 211: Help, 212: hh.exe, 213: icons, 214: idc.ini, 215: ie7, 216: ie7updates, 217: iexplore.exe, 218: iis6.log, 219: ime, 220: imsins.log, 221: inf, 222: Installer, 223: Internet Logs, 224: Interop.SHDocVw.dll, 225: IsUn040c.exe, 226: IsUninst.exe, 227: java, 228: JM, 229: Jour de pêche.bmp, 230: kaillera.ini, 231: Lhsp, 232: Logs, 233: Media, 234: MegaManager.INI, 235: Microsoft.NET, 236: Minidump, 237: MList.INI, 238: mmproxy_40.mdb, 239: mmproxy_40_Backup.mdb, 240: mozver.dat, 241: msagent, 242: msapps, 243: MSCompPackV1Uninst.log, 244: msdfmap.ini, 245: msgsocm.log, 246: mui, 247: Mur de Santa Fe.bmp, 248: NAVIGMA.INI, 249: NeroDigital.ini, 250: network diagnostic, 251: notepad.exe, 252: nsreg.dat, 253: ntdtcsetup.log, 254: nview, 255: ocgen.log, 256: ocmsn.log, 257: ODBC.INI, 258: ODBCINST.INI, 259: Offline Web Pages, 260: onglet affichage, 261: OPTIONS, 262: ov530dib.dll, 263: OvtCam, 264: PCDLIB32.DLL, 265: PCDNSetting.ini, 266: pchealth, 267: PeerNet, 268: PhotoSnapViewer.INI, 269: PIF, 270: Plume.bmp, 271: powerplayer.ini, 272: PPSMediaList.ini, 273: Prefetch, 274: Provisioning, 275: psnetwork.ini, 276: pss, 277: regedit.exe, 278: RegisteredPackages, 279: Registration, 280: repair, 281: Resources, 282: Revival.INI, 283: Revsrvr.INI, 284: Rhododendron.bmp, 285: Rivière Sumida.bmp, 286: Rosace bleue 16.bmp, 287: RTacDbg.txt, 288: S82A1536E.tmp, 289: SchedLgU.Txt, 290: security, 291: SET25.tmp, 292: SET3.tmp, 293: SET4.tmp, 294: setup.iss, 295: setupact.log, 296: setupapi.log, 297: setupapi.log.0.old, 298: setuperr.log, 299: ShellIcon32.dll, 300: SHELLNEW, 301: Shop-n-Spree, 302: SoftwareDistribution, 303: speech, 304: spupdsvc.log, 305: srchasst, 306: Sti_Trace.log, 307: Sun, 308: svcadmin.exe, 309: SxsCaPendDel, 310: system, 311: system.ini, 312: system32, 313: taskman.exe, 314: Tasks, 315: Tasse à café.bmp, 316: Temp, 317: tsoc.log, 318: twain.dll, 319: twain_32, 320: twain_32.dll, 321: twunk_16.exe, 322: twunk_32.exe, 323: unin040c.exe, 324: unins000.dat, 325: unins000.exe, 326: uninst.exe, 327: UNNeroShowTime.cfg, 328: UNNeroShowTime.exe, 329: UNNeroVision.cfg, 330: UNNeroVision.exe, 331: UNNMP.cfg, 332: UNNMP.exe, 333: unvise32.exe, 334: usdthank.ini, 335: vb.ini, 336: vbaddin.ini, 337: Vent de prairie.bmp, 338: vmmreg32.dll, 339: VPersonality.INI, 340: WA.INI, 341: WB.ini, 342: WBEM, 343: Web, 344: wiadebug.log, 345: wiaservc.log, 346: win.ini, 347: windllreg1c.sys, 348: WindowsShell.Manifest, 349: WindowsUpdate.log, 350: winhelp.exe, 351: winhlp32.exe, 352: wininit.ini 13:39:12,5290386 SexyCity.exe 564 QueryDirectory C:\WINDOWS SUCCESS 0: winnt.bmp, 1: winnt256.bmp, 2: WinSxS, 3: wldtlk20.ini, 4: WLXPGSS.SCR, 5: WMPrfChs.prx, 6: WMPrfCht.prx, 7: WMPrfDeu.prx, 8: WMPrfEsp.prx, 9: WMPrfFra.prx, 10: WMPrfIta.prx, 11: WMPrfJpn.prx, 12: WMPrfKor.prx, 13: WMSysPr9.prx, 14: Zapotec.bmp, 15: _default.pif 13:39:12,5291099 SexyCity.exe 564 QueryDirectory C:\WINDOWS NO MORE FILES 13:39:12,5291574 SexyCity.exe 564 CloseFile C:\WINDOWS SUCCESS 13:39:12,5292693 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5293458 SexyCity.exe 564 QueryDirectory C:\WINDOWS\AppPatch SUCCESS 0: ., 1: .., 2: acadproc.dll, 3: AcGenral.dll, 4: AcLayers.dll, 5: AcLua.dll, 6: AcSpecfc.dll, 7: AcXtrnal.dll, 8: apphelp.sdb, 9: apph_sp.sdb, 10: drvmain.sdb, 11: msimain.sdb, 12: sysmain.sdb 13:39:12,5294496 SexyCity.exe 564 QueryDirectory C:\WINDOWS\AppPatch NO MORE FILES 13:39:12,5295192 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch SUCCESS 13:39:12,5296276 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5297056 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly SUCCESS 0: ., 1: .., 2: Desktop.ini, 3: GAC, 4: GAC_32, 5: GAC_MSIL, 6: NativeImages1_v1.1.4322, 7: NativeImages_v2.0.50727_32, 8: NativeImages_v4.0(2).30319_32, 9: NativeImages_v4.0.30319_32, 10: PublisherPolicy.tme, 11: pubpol6.dat, 12: temp, 13: tmp 13:39:12,5298038 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly NO MORE FILES 13:39:12,5298776 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly SUCCESS 13:39:12,5300133 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5301182 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_32 SUCCESS 0: ., 1: .., 2: CustomMarshalers, 3: ISymWrapper, 4: Microsoft.Transactions.Bridge.Dtc, 5: Microsoft.VisualC.VSCodeParser, 6: mscorcfg, 7: mscorlib, 8: policy.1.0.StorePluginInterface, 9: PresentationCore, 10: StorePluginInterface, 11: System.Data, 12: System.Data.OracleClient, 13: System.EnterpriseServices, 14: System.Printing, 15: System.Transactions, 16: System.Web 13:39:12,5302870 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_32 NO MORE FILES 13:39:12,5303934 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_32 SUCCESS 13:39:12,5306253 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5308389 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_32\mscorlib SUCCESS 0: ., 1: .., 2: 2.0.0.0__b77a5c561934e089 13:39:12,5309866 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_32\mscorlib NO MORE FILES 13:39:12,5311040 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_32\mscorlib SUCCESS 13:39:12,5312981 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__B77A5C561934E089 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5314560 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089 SUCCESS 0: ., 1: .., 2: mscorlib.dll 13:39:12,5315993 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089 NO MORE FILES 13:39:12,5317166 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089 SUCCESS 13:39:12,5318769 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5319813 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL SUCCESS 0: ., 1: .., 2: Accessibility, 3: AspNetMMCExt, 4: AspNetMMCExt.resources, 5: CppCodeProvider, 6: cscompmgd, 7: IEExecRemote, 8: IEHost, 9: IIEHost, 10: Microsoft.Build.Conversion.v3.5, 11: Microsoft.Build.Conversion.v3.5.resources, 12: Microsoft.Build.Engine, 13: Microsoft.Build.Engine.resources, 14: Microsoft.Build.Framework, 15: Microsoft.Build.Tasks, 16: Microsoft.Build.Tasks.resources, 17: Microsoft.Build.Tasks.v3.5, 18: Microsoft.Build.Tasks.v3.5.resources, 19: Microsoft.Build.Utilities, 20: microsoft.build.utilities.resources, 21: Microsoft.Build.Utilities.v3.5, 22: Microsoft.Build.Utilities.v3.5.resources, 23: Microsoft.JScript, 24: Microsoft.Jscript.resources, 25: Microsoft.MSXML, 26: Microsoft.Transactions.Bridge, 27: microsoft.transactions.bridge.dtc.resources, 28: microsoft.transactions.bridge.resources, 29: Microsoft.VisualBasic, 30: Microsoft.VisualBasic.Compatibility, 31: Microsoft.VisualBasic.Compatibility.Data, 32: microsoft.visualbasic.compatibility.data.resources, 33: microsoft.visualbasic.compatibility.resources, 34: Microsoft.VisualBasic.resources, 35: Microsoft.VisualBasic.Vsa, 36: Microsoft.VisualC, 37: Microsoft.VisualC.STLCLR, 38: Microsoft.VisualC.VSCodeProvider, 39: Microsoft.VisualStudio, 40: Microsoft.VisualStudio.CommonIDE, 41: Microsoft.VisualStudio.CommonIDE.resources, 42: Microsoft.VisualStudio.Configuration, 43: Microsoft.VisualStudio.Configuration.resources, 44: Microsoft.VisualStudio.Data.Core, 45: Microsoft.VisualStudio.Data.Core.resources, 46: Microsoft.VisualStudio.Data.Framework, 47: Microsoft.VisualStudio.Data.Framework.resources, 48: Microsoft.VisualStudio.Data.Services, 49: Microsoft.VisualStudio.Data.Services.resources, 50: Microsoft.VisualStudio.DebuggerVisualizers, 51: Microsoft.VisualStudio.Design, 52: Microsoft.VisualStudio.Design.resources, 53: Microsoft.VisualStudio.Editors, 54: Microsoft.VisualStudio.Editors.resources, 55: Microsoft.VisualStudio.ManagedInterfaces, 56: Microsoft.VisualStudio.ManagedInterfaces.9.0, 57: Microsoft.VisualStudio.ManagedInterfaces.WCF, 58: Microsoft.VisualStudio.Package.LanguageService, 59: Microsoft.VisualStudio.Package.LanguageService.9.0, 60: Microsoft.VisualStudio.Package.LanguageService.9.0.resources, 61: Microsoft.VisualStudio.Package.LanguageService.resources, 62: Microsoft.VisualStudio.ProjectAggregator, 63: microsoft.visualstudio.resources, 64: Microsoft.VisualStudio.Shell, 65: Microsoft.VisualStudio.Shell.9.0, 66: Microsoft.VisualStudio.Shell.9.0.resources, 67: Microsoft.VisualStudio.Shell.Design, 68: Microsoft.VisualStudio.Shell.Design.resources, 69: Microsoft.VisualStudio.Shell.resources, 70: Microsoft.VisualStudio.TemplateWizardInterface, 71: Microsoft.VisualStudio.VSContentInstaller, 72: Microsoft.VisualStudio.WCFReference.Interop, 73: Microsoft.VisualStudio.Windows.Forms, 74: Microsoft.VisualStudio.Windows.Forms.resources, 75: Microsoft.VisualStudio.WizardFramework, 76: Microsoft.VisualStudio.WizardFramework.resources, 77: Microsoft.VisualStudio.XmlEditor, 78: Microsoft.VisualStudio.Zip, 79: Microsoft.VisualStudio.Zip.9.0, 80: Microsoft.VisualStudio.Zip.9.0.resources, 81: Microsoft.VisualStudio.Zip.resources, 82: Microsoft.Vsa, 83: Microsoft.Vsa.Vb.CodeDOMProcessor, 84: Microsoft.VSDesigner, 85: Microsoft.VSDesigner.resources, 86: Microsoft_VsaVb, 87: mscorcfg.resources, 88: mscorlib.resources, 89: msddslmp, 90: msddsp, 91: PresentationBuildTasks, 92: PresentationBuildTasks.resources, 93: PresentationCFFRasterizer, 94: PresentationCore.resources, 95: PresentationFontCache, 96: PresentationFramework, 97: PresentationFramework.Aero, 98: PresentationFramework.Classic, 99: PresentationFramework.Luna, 100: PresentationFramework.resources, 101: PresentationFramework.Royale, 102: PresentationUI, 103: PresentationUI.resources, 104: ReachFramework, 105: ReachFramework.resources, 106: Sentinel.v3.5Client, 107: SMDiagnostics, 108: smdiagnostics.resources, 109: sysglobl, 110: sysglobl.resources, 111: System, 112: System.AddIn, 113: System.AddIn.Contract, 114: System.ComponentModel.DataAnnotations, 115: System.ComponentModel.DataAnnotations.resources, 116: System.Configuration, 117: System.Configuration.Install, 118: System.Configuration.Install.resources, 119: system.configuration.resources, 120: System.Core, 121: System.Core.resources, 122: System.Data.DataSetExtensions, 123: System.Data.DataSetExtensions.resources, 124: System.Data.Entity, 125: System.Data.Entity.Design, 126: System.Data.Entity.Design.resources, 127: System.Data.Entity.resources, 128: System.Data.Linq, 129: System.Data.Linq.resources, 130: System.Data.OracleClient.resources, 131: System.Data.resources, 132: System.Data.Services, 133: System.Data.Services.Client, 134: System.Data.Services.Client.resources, 135: System.Data.Services.Design, 136: System.Data.Services.Design.resources, 137: System.Data.Services.resources, 138: System.Data.SqlServerCe, 139: System.Data.SqlXml, 140: System.Data.SqlXml.resources, 141: System.Deployment, 142: System.Deployment.resources, 143: System.Design, 144: System.Design.resources, 145: System.DirectoryServices, 146: System.DirectoryServices.AccountManagement, 147: System.DirectoryServices.AccountManagement.resources, 148: System.DirectoryServices.Protocols, 149: System.DirectoryServices.Protocols.resources, 150: System.DirectoryServices.resources, 151: System.Drawing, 152: System.Drawing.Design, 153: System.Drawing.Design.resources, 154: System.Drawing.resources, 155: System.EnterpriseServices.resources, 156: System.IdentityModel, 157: system.identitymodel.resources, 158: System.IdentityModel.Selectors, 159: system.identitymodel.selectors.resources, 160: System.IO.Log, 161: system.io.log.resources, 162: System.Management, 163: System.Management.Instrumentation, 164: System.Management.Instrumentation.resources, 165: System.Management.resources, 166: System.Messaging, 167: System.Messaging.resources, 168: System.Net, 169: System.Net.resources, 170: System.Printing.resources, 171: System.resources, 172: System.Runtime.Remoting, 173: System.Runtime.Remoting.resources, 174: System.Runtime.Serialization, 175: System.Runtime.Serialization.Formatters.Soap, 176: System.Runtime.Serialization.Formatters.Soap.resources, 177: system.runtime.serialization.resources, 178: System.Security, 179: System.Security.resources, 180: System.ServiceModel, 181: System.ServiceModel.Install, 182: system.servicemodel.install.resources, 183: system.servicemodel.resources, 184: System.ServiceModel.WasHosting, 185: System.ServiceModel.Web, 186: System.ServiceModel.Web.resources, 187: System.ServiceProcess, 188: System.ServiceProcess.resources, 189: System.Speech, 190: System.Speech.resources, 191: System.Transactions.resources, 192: System.Web.Abstractions, 193: System.Web.Abstractions.resources, 194: System.Web.DynamicData, 195: System.Web.DynamicData.Design, 196: System.Web.DynamicData.Design.resources, 197: System.Web.DynamicData.resources, 198: System.Web.Entity, 199: System.Web.Entity.Design, 200: System.Web.Entity.Design.resources, 201: System.Web.Entity.resources, 202: System.Web.Extensions, 203: System.Web.Extensions.Design, 204: System.Web.Extensions.Design.resources, 205: System.Web.Extensions.resources, 206: System.Web.Mobile, 207: System.Web.Mobile.resources, 208: System.Web.RegularExpressions, 209: System.Web.resources, 210: System.Web.Routing, 211: System.Web.Routing.resources, 212: System.Web.Services, 213: System.Web.Services.resources, 214: System.Windows.Forms, 215: System.Windows.Forms.resources, 216: System.Windows.Presentation, 217: System.Windows.Presentation.resources, 218: System.Workflow.Activities, 219: system.workflow.activities.resources, 220: System.Workflow.ComponentModel, 221: system.workflow.componentmodel.resources, 222: System.Workflow.Runtime, 223: system.workflow.runtime.resources, 224: System.WorkflowServices, 225: System.WorkflowServices.resources, 226: System.Xml, 227: System.Xml.Linq, 228: System.Xml.Linq.resources, 229: System.XML.resources 13:39:12,5322992 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL SUCCESS 0: UIAutomationClient, 1: UIAutomationClient.resources, 2: UIAutomationClientsideProviders, 3: UIAutomationClientsideProviders.resources, 4: UIAutomationProvider, 5: UIAutomationProvider.resources, 6: UIAutomationTypes, 7: UIAutomationTypes.resources, 8: WindowsBase, 9: WindowsBase.resources, 10: WindowsFormsIntegration, 11: WindowsFormsIntegration.resources 13:39:12,5324434 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL NO MORE FILES 13:39:12,5325447 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL SUCCESS 13:39:12,5327342 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5329193 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic SUCCESS 0: ., 1: .., 2: 8.0.0.0__b03f5f7f11d50a3a 13:39:12,5330442 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic NO MORE FILES 13:39:12,5331409 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic SUCCESS 13:39:12,5333178 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__B03F5F7F11D50A3A SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5334419 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a SUCCESS 0: ., 1: .., 2: Microsoft.VisualBasic.dll 13:39:12,5335569 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a NO MORE FILES 13:39:12,5336516 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a SUCCESS 13:39:12,5338113 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\SYSTEM.RUNTIME.REMOTING SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5339347 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting SUCCESS 0: ., 1: .., 2: 2.0.0.0__b77a5c561934e089 13:39:12,5340504 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting NO MORE FILES 13:39:12,5341444 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting SUCCESS 13:39:12,5343219 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__B77A5C561934E089 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5344759 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089 SUCCESS 0: ., 1: .., 2: System.Runtime.Remoting.dll 13:39:12,5346202 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089 NO MORE FILES 13:39:12,5347209 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089 SUCCESS 13:39:12,5348936 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\SYSTEM.WINDOWS.FORMS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5350183 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms SUCCESS 0: ., 1: .., 2: 2.0.0.0__b77a5c561934e089 13:39:12,5351401 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms NO MORE FILES 13:39:12,5352344 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms SUCCESS 13:39:12,5354396 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__B77A5C561934E089 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5355628 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089 SUCCESS 0: ., 1: .., 2: System.Windows.Forms.dll 13:39:12,5356787 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089 NO MORE FILES 13:39:12,5357748 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089 SUCCESS 13:39:12,5359106 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NATIVEIMAGES_V2.0.50727_32 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5359897 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32 SUCCESS 0: ., 1: .., 2: Accessibility, 3: EnvDTE, 4: EnvDTE80, 5: EnvDTE90, 6: index34a.dat, 7: index34b.dat, 8: index46c.dat, 9: index46d.dat, 10: MetaGen, 11: Microsoft.Build.Con#, 12: Microsoft.Build.Eng#, 13: Microsoft.Build.Fra#, 14: Microsoft.Build.Tas#, 15: Microsoft.Build.Uti#, 16: Microsoft.Internal.#, 17: Microsoft.JScript, 18: Microsoft.VisualStu#, 19: Microsoft.Vsa, 20: MSBuild, 21: mscorlib, 22: PresentationBuildTa#, 23: PresentationCFFRast#, 24: PresentationCore, 25: PresentationFontCac#, 26: PresentationFramewo#, 27: PresentationUI, 28: ReachFramework, 29: System, 30: System.AddIn, 31: System.AddIn.Contra#, 32: System.ComponentMod#, 33: System.Configuratio#, 34: System.Configuration, 35: System.Core, 36: System.Data.DataSet#, 37: System.Data.Entity, 38: System.Data.Entity.#, 39: System.Data.Linq, 40: System.Data.Service#, 41: System.Data.Services, 42: System.Data.SqlXml, 43: System.Deployment, 44: System.DirectorySer#, 45: System.Drawing, 46: System.Management, 47: System.Management.I#, 48: System.Net, 49: System.Printing, 50: System.Runtime.Seri#, 51: System.Security, 52: System.ServiceModel#, 53: System.Web, 54: System.Web.Abstract#, 55: System.Web.DynamicD#, 56: System.Web.Entity, 57: System.Web.Entity.D#, 58: System.Web.Extensio#, 59: System.Web.Routing, 60: System.Windows.Forms, 61: System.Windows.Pres#, 62: System.WorkflowServ#, 63: System.Xml, 64: System.Xml.Linq, 65: Temp, 66: UIAutomationClient, 67: UIAutomationClients#, 68: UIAutomationProvider, 69: UIAutomationTypes, 70: WindowsBase, 71: WindowsFormsIntegra# 13:39:12,5361513 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32 NO MORE FILES 13:39:12,5362224 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32 SUCCESS 13:39:12,5364249 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5366427 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib SUCCESS 0: ., 1: .., 2: 9adb89fa22fd5b4ce433b5aca7fb1b07 13:39:12,5368095 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib NO MORE FILES 13:39:12,5369192 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib SUCCESS 13:39:12,5371398 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9ADB89FA22FD5B4CE433B5ACA7FB1B07 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5373185 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07 SUCCESS 0: ., 1: .., 2: mscorlib.ni.dll 13:39:12,5374452 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07 NO MORE FILES 13:39:12,5375910 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07 SUCCESS 13:39:12,5377825 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\SYSTEM.DRAWING SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5378905 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing SUCCESS 0: ., 1: .., 2: 6978f2e90f13bc720d57fa6895c911e2 13:39:12,5380287 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing NO MORE FILES 13:39:12,5381028 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing SUCCESS 13:39:12,5383056 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978F2E90F13BC720D57FA6895C911E2 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5383983 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2 SUCCESS 0: ., 1: .., 2: System.Drawing.ni.dll 13:39:12,5385354 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2 NO MORE FILES 13:39:12,5386088 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2 SUCCESS 13:39:12,5388008 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\SYSTEM.WINDOWS.FORMS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5389033 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms SUCCESS 0: ., 1: .., 2: 9a254c455892c02355ab0ab0f0727c5b 13:39:12,5390170 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms NO MORE FILES 13:39:12,5391261 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms SUCCESS 13:39:12,5393261 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9A254C455892C02355AB0AB0F0727C5B SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5394258 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b SUCCESS 0: ., 1: .., 2: System.Windows.Forms.ni.dll 13:39:12,5395732 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b NO MORE FILES 13:39:12,5396458 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b SUCCESS 13:39:12,5398573 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5400268 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System SUCCESS 0: ., 1: .., 2: aa7926460a336408c8041330ad90929d 13:39:12,5401575 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System NO MORE FILES 13:39:12,5403021 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System SUCCESS 13:39:12,5404615 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\AA7926460A336408C8041330AD90929D SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5406293 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d SUCCESS 0: ., 1: .., 2: System.ni.dll 13:39:12,5407993 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d NO MORE FILES 13:39:12,5408986 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d SUCCESS 13:39:12,5410798 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5411656 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Fonts SUCCESS 0: ., 1: .., 2: 8514fix.fon, 3: 8514fixe.fon, 4: 8514fixg.fon, 5: 8514fixr.fon, 6: 8514fixt.fon, 7: 8514oem.fon, 8: 8514oeme.fon, 9: 8514oemg.fon, 10: 8514oemr.fon, 11: 8514oemt.fon, 12: 8514sys.fon, 13: 8514syse.fon, 14: 8514sysg.fon, 15: 8514sysr.fon, 16: 8514syst.fon, 17: 85775.fon, 18: 85855.fon, 19: 85f1255.fon, 20: 85f1256.fon, 21: 85f1257.fon, 22: 85f874.fon, 23: 85s1255.fon, 24: 85s1256.fon, 25: 85s1257.fon, 26: 85s874.fon, 27: ACaslonPro-Bold.otf, 28: ACaslonPro-BoldItalic.otf, 29: ACaslonPro-Italic.otf, 30: ACaslonPro-Regular.otf, 31: ACaslonPro-Semibold.otf, 32: ACaslonPro-SemiboldItalic.otf, 33: AdobeArabic-Bold.otf, 34: AdobeArabic-BoldItalic.otf, 35: AdobeArabic-Italic.otf, 36: AdobeArabic-Regular.otf, 37: AdobeFangsongStd-Regular.otf, 38: AdobeFanHeitiStd-Bold.otf, 39: AdobeGothicStd-Bold.otf, 40: AdobeHebrew-Bold.otf, 41: AdobeHebrew-BoldItalic.otf, 42: AdobeHebrew-Italic.otf, 43: AdobeHebrew-Regular.otf, 44: AdobeHeitiStd-Regular.otf, 45: AdobeKaitiStd-Regular.otf, 46: AdobeMingStd-Light.otf, 47: AdobeMyungjoStd-Medium.otf, 48: AdobeSongStd-Light.otf, 49: AGaramondPro-Bold.otf, 50: AGaramondPro-BoldItalic.otf, 51: AGaramondPro-Italic.otf, 52: AGaramondPro-Regular.otf, 53: AGENCYB.TTF, 54: AGENCYR.TTF, 55: ahronbd.ttf, 56: ALGER.TTF, 57: andlso.ttf, 58: ANDMOIPA.TTF, 59: ANGSA.TTF, 60: ANGSAB.TTF, 61: ANGSAI.TTF, 62: ANGSAU.TTF, 63: ANGSAUB.TTF, 64: ANGSAUI.TTF, 65: ANGSAUZ.TTF, 66: ANGSAZ.TTF, 67: ANTQUAB.TTF, 68: ANTQUABI.TTF, 69: ANTQUAI.TTF, 70: app775.fon, 71: app850.fon, 72: app852.fon, 73: app855.fon, 74: app857.fon, 75: app866.fon, 76: app932.fon, 77: app936.fon, 78: app949.fon, 79: app950.fon, 80: ARBLI___.TTF, 81: arialbd.ttf, 82: arialbi.ttf, 83: ariali.ttf, 84: ARIALN.TTF, 85: ARIALNB.TTF, 86: ARIALNBI.TTF, 87: ARIALNI.TTF, 88: ARIALUNI.TTF, 89: ariblk.ttf, 90: ARLRDBD.TTF, 91: artrbdo.ttf, 92: artro.ttf, 93: BASKVILL.TTF, 94: batang.ttc, 95: BAUHS93.TTF, 96: BELL.TTF, 97: BELLB.TTF, 98: BELLI.TTF, 99: BERKLEY_.TTF, 100: BERNHC.TTF, 101: BirchStd.otf, 102: BKANT.TTF, 103: BlackoakStd.otf, 104: BLANCAN_.TTF, 105: bluebold.ttf, 106: bluecond.ttf, 107: bluehigh.ttf, 108: bluehigl.ttf, 109: BOD_B.TTF, 110: BOD_BI.TTF, 111: BOD_BLAI.TTF, 112: BOD_BLAR.TTF, 113: BOD_CB.TTF, 114: BOD_CBI.TTF, 115: BOD_CI.TTF, 116: BOD_CR.TTF, 117: BOD_I.TTF, 118: BOD_PSTC.TTF, 119: BOD_R.TTF, 120: BONNIEN_.TTF, 121: BOOKOS.TTF, 122: BOOKOSB.TTF, 123: BOOKOSBI.TTF, 124: BOOKOSI.TTF, 125: BRADHITC.TTF, 126: BRAZILN_.TTF, 127: BRIAN___.TTF, 128: BRITANIC.TTF, 129: BRLNSB.TTF, 130: BRLNSDB.TTF, 131: BRLNSR.TTF, 132: BROADW.TTF, 133: BROWA.TTF, 134: BROWAB.TTF, 135: BROWAI.TTF, 136: BROWAU.TTF, 137: BROWAUB.TTF, 138: BROWAUI.TTF, 139: BROWAUZ.TTF, 140: BROWAZ.TTF, 141: BRUSHSCI.TTF, 142: BrushScriptStd.otf, 143: BSSYM7.TTF, 144: c8514fix.fon, 145: c8514oem.fon, 146: c8514sys.fon, 147: CALIBRI.TTF, 148: CALIBRIB.TTF, 149: CALIBRII.TTF, 150: CALIBRIZ.TTF, 151: CALIFB.TTF, 152: CALIFI.TTF, 153: CALIFR.TTF, 154: CALIST.TTF, 155: CALISTB.TTF, 156: CALISTBI.TTF, 157: CALISTI.TTF, 158: CAROLAN_.TTF, 159: CARTERN_.TTF, 160: CASTELAR.TTF, 161: CENAN___.TTF, 162: CENSCBK.TTF, 163: CENTAUR.TTF, 164: CENTURY.TTF, 165: cga40737.fon, 166: cga40850.fon, 167: cga40852.fon, 168: cga40857.fon, 169: cga40866.fon, 170: cga40869.fon, 171: cga40woa.fon, 172: cga80737.fon, 173: cga80850.fon, 174: cga80852.fon, 175: cga80857.fon, 176: cga80866.fon, 177: cga80869.fon, 178: cga80woa.fon, 179: ChaparralPro-Bold.otf, 180: ChaparralPro-BoldIt.otf, 181: ChaparralPro-Italic.otf, 182: ChaparralPro-Regular.otf, 183: CharlemagneStd-Bold.otf, 184: CHILLER.TTF, 185: CHRISTY_.TTF, 186: COLONNA.TTF, 187: comic.ttf, 188: comicbd.ttf, 189: COOPBL.TTF, 190: CooperBlackStd-Italic.otf, 191: CooperBlackStd.otf, 192: COPRGTB.TTF, 193: COPRGTL.TTF, 194: CORDIA.TTF, 195: CORDIAB.TTF, 196: CORDIAI.TTF, 197: CORDIAU.TTF, 198: CORDIAUB.TTF, 199: CORDIAUI.TTF, 200: CORDIAUZ.TTF, 201: CORDIAZ.TTF, 202: coue1255.fon, 203: coue1256.fon, 204: coue1257.fon, 205: couf1255.fon, 206: couf1256.fon, 207: couf1257.fon, 208: cour.ttf, 209: courbd.ttf, 210: courbi.ttf, 211: coure.fon, 212: couree.fon, 213: coureg.fon, 214: courer.fon, 215: couret.fon, 216: courf.fon, 217: courfe.fon, 218: courfg.fon, 219: courfr.fon, 220: courft.fon, 221: couri.ttf, 222: CURLZ___.TTF, 223: cvgafix.fon, 224: cvgasys.fon, 225: DARLING_.TTF, 226: david.ttf, 227: davidbd.ttf, 228: davidtr.ttf, 229: DECODEN_.TTF, 230: DejaVuCondensedSans.ttf, 231: DejaVuCondensedSansBold.ttf, 232: DejaVuCondensedSansBoldOblique.ttf, 233: DejaVuCondensedSansOblique.ttf, 234: DejaVuCondensedSerif.ttf, 235: DejaVuCondensedSerifBold.ttf, 236: DejaVuCondensedSerifBoldItalic.ttf, 237: DejaVuCondensedSerifItalic.ttf, 238: DejaVuMonoSans.ttf, 239: DejaVuMonoSansBold.ttf, 240: DejaVuMonoSansBoldOblique.ttf, 241: DejaVuMonoSansOblique.ttf, 242: DejaVuSans.ttf, 243: DejaVuSansBold.ttf, 244: DejaVuSansBoldOblique.ttf, 245: DejaVuSansExtraLight.ttf, 246: DejaVuSansOblique.ttf, 247: DejaVuSerif.ttf, 248: DejaVuSerifBold.ttf, 249: DejaVuSerifBoldItalic.ttf, 250: DejaVuSerifItalic.ttf, 251: DELANEY_.TTF, 252: desktop.ini, 253: digital.ttf, 254: dos737.fon, 255: dosapp.fon, 256: ega40737.fon, 257: ega40850.fon, 258: ega40852.fon, 259: ega40857.fon, 260: ega40866.fon, 261: ega40869.fon, 262: ega40woa.fon, 263: ega80737.fon, 264: ega80850.fon, 265: ega80852.fon, 266: ega80857.fon, 267: ega80866.fon, 268: ega80869.fon, 269: ega80woa.fon, 270: ELEPHNT.TTF, 271: ELEPHNTI.TTF, 272: ELLISN__.TTF, 273: ENGR.TTF, 274: ERASBD.TTF, 275: ERASDEMI.TTF, 276: ERASLGHT.TTF, 277: ERASMD.TTF, 278: estre.ttf, 279: FELIXTI.TTF, 280: FORTE.TTF, 281: FRABK.TTF, 282: FRABKIT.TTF, 283: FRADM.TTF, 284: FRADMCN.TTF, 285: FRADMIT.TTF, 286: FRAHV.TTF, 287: FRAHVIT.TTF, 288: framd.ttf, 289: FRAMDCN.TTF, 290: framdit.ttf, 291: frank.ttf, 292: FREESCPT.TTF, 293: FRSCRIPT.TTF, 294: FTLTLT.TTF, 295: GARA.TTF, 296: GARABD.TTF, 297: GARAIT.TTF, 298: gautami.ttf, 299: georgia.ttf, 300: georgiab.ttf, 301: georgiai.ttf, 302: georgiaz.ttf, 303: GiddyupStd.otf, 304: GIGI.TTF, 305: GILBI___.TTF, 306: GILB____.TTF, 307: GILC____.TTF, 308: GILI____.TTF, 309: GILLUBCD.TTF, 310: GILSANUB.TTF, 311: GIL_____.TTF, 312: GLECB.TTF, 313: GlobalMonospace.CompositeFont, 314: GlobalSansSerif.CompositeFont, 315: GlobalSerif.CompositeFont, 316: GlobalUserInterface.CompositeFont, 317: GLSNECB.TTF, 318: GOTHIC.TTF, 319: GOTHICB.TTF, 320: GOTHICBI.TTF, 321: GOTHICI.TTF, 322: GOUDOS.TTF, 323: GOUDOSB.TTF, 324: GOUDOSI.TTF, 325: GOUDYSTO.TTF, 326: gulim.ttc, 327: h8514fix.fon, 328: h8514oem.fon, 329: h8514sys.fon, 330: HARLOWSI.TTF, 331: HARNGTON.TTF, 332: HATTEN.TTF, 333: HoboStd.otf, 334: HTOWERT.TTF, 335: HTOWERTI.TTF, 336: hvgafix.fon, 337: hvgasys.fon, 338: impact.ttf, 339: IMPRISHA.TTF, 340: INFROMAN.TTF, 341: ITCBLKAD.TTF, 342: ITCEDSCR.TTF, 343: ITCKRIST.TTF, 344: j8514fix.fon, 345: j8514oem.fon, 346: j8514sys.fon, 347: JOKERMAN.TTF, 348: jsmalle.fon, 349: jsmallf.fon, 350: JUICE___.TTF, 351: jvgafix.fon, 352: jvgasys.fon, 353: kartika.ttf, 354: KozGoPr6N-Bold.otf, 355: KozGoPr6N-ExtraLight.otf, 356: KozGoPr6N-Heavy.otf, 357: KozGoPr6N-Light.otf, 358: KozGoPr6N-Medium.otf, 359: KozGoPr6N-Regular.otf, 360: KozGoPro-Bold.otf, 361: KozGoPro-ExtraLight.otf, 362: KozGoPro-Heavy.otf, 363: KozGoPro-Light.otf, 364: KozGoPro-Medium.otf, 365: KozGoPro-Regular.otf, 366: KozMinPr6N-Bold.otf, 367: KozMinPr6N-ExtraLight.otf, 368: KozMinPr6N-Heavy.otf, 369: KozMinPr6N-Light.otf, 370: KozMinPr6N-Medium.otf, 371: KozMinPr6N-Regular.otf, 372: KozMinPro-Bold.otf, 373: KozMinPro-ExtraLight.otf, 374: KozMinPro-Heavy.otf, 375: KozMinPro-Light.otf, 376: KozMinPro-Medium.otf, 377: KozMinPro-Regular.otf, 378: KUNSTLER.TTF, 379: latha.ttf, 380: LATINWD.TTF, 381: LBRITE.TTF, 382: LBRITED.TTF, 383: LBRITEDI.TTF, 384: LBRITEI.TTF, 385: LCALLIG.TTF 13:39:12,5414739 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Fonts SUCCESS 0: LetterGothicStd-Bold.otf, 1: LetterGothicStd-BoldSlanted.otf, 2: LetterGothicStd-Slanted.otf, 3: LetterGothicStd.otf, 4: LFAX.TTF, 5: LFAXD.TTF, 6: LFAXDI.TTF, 7: LFAXI.TTF, 8: LHANDW.TTF, 9: LithosPro-Black.otf, 10: LithosPro-Regular.otf, 11: LSANS.TTF, 12: LSANSD.TTF, 13: LSANSDI.TTF, 14: LSANSI.TTF, 15: LTYPE.TTF, 16: LTYPEB.TTF, 17: LTYPEBO.TTF, 18: LTYPEO.TTF, 19: lucon.ttf, 20: lvnm.ttf, 21: lvnmbd.ttf, 22: l_10646.ttf, 23: MAGNETOB.TTF, 24: MAIAN.TTF, 25: mangal.ttf, 26: marlett.ttf, 27: MATURASC.TTF, 28: MesquiteStd.otf, 29: micross.ttf, 30: mingliu.ttc, 31: MinionPro-Bold.otf, 32: MinionPro-BoldCn.otf, 33: MinionPro-BoldCnIt.otf, 34: MinionPro-BoldIt.otf, 35: MinionPro-It.otf, 36: MinionPro-Medium.otf, 37: MinionPro-MediumIt.otf, 38: MinionPro-Regular.otf, 39: MinionPro-Semibold.otf, 40: MinionPro-SemiboldIt.otf, 41: MISTRAL.TTF, 42: MOD20.TTF, 43: modern.fon, 44: mriam.ttf, 45: mriamc.ttf, 46: mriamfx.ttf, 47: mriamtr.ttf, 48: msdlg874.fon, 49: msgothic.ttc, 50: msmincho.ttc, 51: MTCORSVA.TTF, 52: mvboli.ttf, 53: MyriadPro-Bold.otf, 54: MyriadPro-BoldCond.otf, 55: MyriadPro-BoldCondIt.otf, 56: MyriadPro-BoldIt.otf, 57: MyriadPro-Cond.otf, 58: MyriadPro-CondIt.otf, 59: MyriadPro-It.otf, 60: MyriadPro-Regular.otf, 61: MyriadPro-Semibold.otf, 62: MyriadPro-SemiboldIt.otf, 63: NIAGENG.TTF, 64: NIAGSOL.TTF, 65: nrkis.ttf, 66: NuevaStd-BoldCond.otf, 67: NuevaStd-BoldCondItalic.otf, 68: NuevaStd-Cond.otf, 69: NuevaStd-CondItalic.otf, 70: OCRAEXT.TTF, 71: OCRAStd.otf, 72: OLDENGL.TTF, 73: ONYX.TTF, 74: opens___.ttf, 75: OratorStd-Slanted.otf, 76: OratorStd.otf, 77: OUTLOOK.TTF, 78: pala.ttf, 79: palab.ttf, 80: palabi.ttf, 81: palai.ttf, 82: PALSCRI.TTF, 83: PAPYRUS.TTF, 84: PARCHM.TTF, 85: PERBI___.TTF, 86: PERB____.TTF, 87: PERI____.TTF, 88: PERTIBD.TTF, 89: PERTILI.TTF, 90: PER_____.TTF, 91: PLAYBILL.TTF, 92: POORICH.TTF, 93: PoplarStd.otf, 94: PrestigeEliteStd-Bd.otf, 95: PRISTINA.TTF, 96: raavi.ttf, 97: RAGE.TTF, 98: RAVIE.TTF, 99: REFSAN.TTF, 100: REFSPCL.TTF, 101: ROCCB___.TTF, 102: ROCC____.TTF, 103: ROCK.TTF, 104: ROCKB.TTF, 105: ROCKBI.TTF, 106: ROCKEB.TTF, 107: ROCKI.TTF, 108: rod.ttf, 109: rodtr.ttf, 110: roman.fon, 111: RosewoodStd-Regular.otf, 112: s8514fix.fon, 113: s8514oem.fon, 114: s8514sys.fon, 115: SCHLBKB.TTF, 116: SCHLBKBI.TTF, 117: SCHLBKI.TTF, 118: script.fon, 119: SCRIPTBL.TTF, 120: segoeui.ttf, 121: SEGOEUI0.TTF, 122: SEGOEUIB.TTF, 123: SEGOEUII.TTF, 124: SEGOEUIZ.TTF, 125: seguibd.ttf, 126: seguibk.ttf, 127: sere1255.fon, 128: sere1256.fon, 129: sere1257.fon, 130: serf1255.fon, 131: serf1256.fon, 132: serf1257.fon, 133: serife.fon, 134: serifee.fon, 135: serifeg.fon, 136: serifer.fon, 137: serifet.fon, 138: seriff.fon, 139: seriffe.fon, 140: seriffg.fon, 141: seriffr.fon, 142: serifft.fon, 143: SHOWG.TTF, 144: shruti.ttf, 145: simhei.ttf, 146: simpbdo.ttf, 147: simpfxo.ttf, 148: simpo.ttf, 149: simsun.ttc, 150: smae1255.fon, 151: smae1256.fon, 152: smae1257.fon, 153: smaf1255.fon, 154: smaf1256.fon, 155: smaf1257.fon, 156: smalle.fon, 157: smallee.fon, 158: smalleg.fon, 159: smaller.fon, 160: smallet.fon, 161: smallf.fon, 162: smallfe.fon, 163: smallfg.fon, 164: smallfr.fon, 165: smallft.fon, 166: SNAP____.TTF, 167: ssee1255.fon, 168: ssee1256.fon, 169: ssee1257.fon, 170: ssee874.fon, 171: ssef1255.fon, 172: ssef1256.fon, 173: ssef1257.fon, 174: ssef874.fon, 175: sserife.fon, 176: sserifee.fon, 177: sserifeg.fon, 178: sserifer.fon, 179: sserifet.fon, 180: sseriff.fon, 181: sseriffe.fon, 182: sseriffg.fon, 183: sseriffr.fon, 184: sserifft.fon, 185: STENCIL.TTF, 186: StencilStd.otf, 187: svgafix.fon, 188: svgasys.fon, 189: sylfaen.ttf, 190: symbol.ttf, 191: symbole.fon, 192: tahoma.ttf, 193: tahomabd.ttf, 194: TCBI____.TTF, 195: TCB_____.TTF, 196: TCCB____.TTF, 197: TCCEB.TTF, 198: TCCM____.TTF, 199: TCMI____.TTF, 200: TCM_____.TTF, 201: TektonPro-Bold.otf, 202: TektonPro-BoldCond.otf, 203: TektonPro-BoldExt.otf, 204: TektonPro-BoldObl.otf, 205: TEMPSITC.TTF, 206: times.ttf, 207: timesbd.ttf, 208: timesbi.ttf, 209: timesi.ttf, 210: tradbdo.ttf, 211: trado.ttf, 212: TrajanPro-Bold.otf, 213: TrajanPro-Regular.otf, 214: trebuc.ttf, 215: trebucbd.ttf, 216: trebucbi.ttf, 217: trebucit.ttf, 218: tunga.ttf, 219: UPCDB.TTF, 220: UPCDBI.TTF, 221: UPCDI.TTF, 222: UPCDL.TTF, 223: UPCEB.TTF, 224: UPCEBI.TTF, 225: UPCEI.TTF, 226: UPCEL.TTF, 227: UPCFB.TTF, 228: UPCFBI.TTF, 229: UPCFI.TTF, 230: UPCFL.TTF, 231: UPCIB.TTF, 232: UPCIBI.TTF, 233: UPCII.TTF, 234: UPCIL.TTF, 235: UPCJB.TTF, 236: UPCJBI.TTF, 237: UPCJI.TTF, 238: UPCJL.TTF, 239: UPCKB.TTF, 240: UPCKBI.TTF, 241: UPCKI.TTF, 242: UPCKL.TTF, 243: UPCLB.TTF, 244: UPCLBI.TTF, 245: UPCLI.TTF, 246: UPCLL.TTF, 247: verdana.ttf, 248: verdanab.ttf, 249: verdanai.ttf, 250: verdanaz.ttf, 251: vga737.fon, 252: vga775.fon, 253: vga850.fon, 254: vga852.fon, 255: vga855.fon, 256: vga857.fon, 257: vga860.fon, 258: vga863.fon, 259: vga865.fon, 260: vga866.fon, 261: vga869.fon, 262: vga932.fon, 263: vga936.fon, 264: vga949.fon, 265: vga950.fon, 266: vgaf1255.fon, 267: vgaf1256.fon, 268: vgaf1257.fon, 269: vgaf874.fon, 270: vgafix.fon, 271: vgafixe.fon, 272: vgafixg.fon, 273: vgafixr.fon, 274: vgafixt.fon, 275: vgaoem.fon, 276: vgas1255.fon, 277: vgas1256.fon, 278: vgas1257.fon, 279: vgas874.fon, 280: vgasys.fon, 281: vgasyse.fon, 282: vgasysg.fon, 283: vgasysr.fon, 284: vgasyst.fon, 285: VINERITC.TTF, 286: VIVALDII.TTF, 287: VLADIMIR.TTF, 288: vrinda.ttf, 289: webdings.ttf, 290: wingding.ttf, 291: WINGDNG2.TTF, 292: WINGDNG3.TTF, 293: wst_czec.fon, 294: wst_engl.fon, 295: wst_fren.fon, 296: wst_germ.fon, 297: wst_ital.fon, 298: wst_span.fon, 299: wst_swed.fon 13:39:12,5417720 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Fonts NO MORE FILES 13:39:12,5418469 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts SUCCESS 13:39:12,5419545 SexyCity.exe 564 CreateFile C:\WINDOWS\MICROSOFT.NET SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5420551 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET SUCCESS 0: ., 1: .., 2: assembly, 3: DirectX for Managed Code, 4: Framework, 5: NETFXRepair.1025.dll, 6: NETFXRepair.1028.dll, 7: NETFXRepair.1029.dll, 8: NETFXRepair.1030.dll, 9: NETFXRepair.1031.dll, 10: NETFXRepair.1032.dll, 11: NETFXRepair.1033.dll, 12: NETFXRepair.1035.dll, 13: NETFXRepair.1036.dll, 14: NETFXRepair.1037.dll, 15: NETFXRepair.1038.dll, 16: NETFXRepair.1040.dll, 17: NETFXRepair.1041.dll, 18: NETFXRepair.1042.dll, 19: NETFXRepair.1043.dll, 20: NETFXRepair.1044.dll, 21: NETFXRepair.1045.dll, 22: NETFXRepair.1046.dll, 23: NETFXRepair.1049.dll, 24: NETFXRepair.1053.dll, 25: NETFXRepair.1055.dll, 26: NETFXRepair.2052.dll, 27: NETFXRepair.2070.dll, 28: NETFXRepair.3076.dll, 29: NETFXRepair.3082.dll, 30: NETFXRepair.exe 13:39:12,5421519 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET NO MORE FILES 13:39:12,5421987 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET SUCCESS 13:39:12,5423792 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\FRAMEWORK SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5424307 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework SUCCESS 0: ., 1: .., 2: NETFXSBS10.exe, 3: NETFXSBS10.hkf, 4: netfxsbs12.hkf, 5: sbscmp10.dll, 6: sbscmp20_mscorlib.dll, 7: sbscmp20_mscorwks.dll, 8: sbscmp20_perfcounter.dll, 9: sbs_diasymreader.dll, 10: sbs_iehost.dll, 11: sbs_microsoft.jscript.dll, 12: sbs_microsoft.vsa.vb.codedomprocessor.dll, 13: sbs_mscordbi.dll, 14: sbs_mscorrc.dll, 15: sbs_mscorsec.dll, 16: sbs_system.configuration.install.dll, 17: sbs_system.data.dll, 18: sbs_system.enterpriseservices.dll, 19: sbs_VsaVb7rt.dll, 20: sbs_wminet_utils.dll, 21: SharedReg12.dll, 22: v1.0.3705, 23: v1.1.4322, 24: v2.0.50727, 25: v3.0, 26: v3.5, 27: v4.0.30319 13:39:12,5425638 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework NO MORE FILES 13:39:12,5426103 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework SUCCESS 13:39:12,5427208 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\V2.0.50727 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5428224 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727 SUCCESS 0: ., 1: .., 2: 1033, 3: 1036, 4: 1036(2), 5: 1036(3), 6: Accessibility.dll, 7: AdoNetDiag.dll, 8: adonetdiag.mof, 9: alink.dll, 10: AppLaunch.exe, 11: ASP(2).NETWebAdminFiles, 12: ASP(3).NETWebAdminFiles, 13: ASP.NETWebAdminFiles, 14: Aspnet.config, 15: aspnet.mof, 16: aspnet.mof.uninstall, 17: AspNetMMCExt.dll, 18: aspnet_compiler.exe, 19: aspnet_filter.dll, 20: aspnet_isapi.dll, 21: Aspnet_perf.dll, 22: aspnet_perf.h, 23: aspnet_perf.ini, 24: aspnet_perf2.ini, 25: aspnet_rc.dll, 26: aspnet_regbrowsers.exe, 27: aspnet_regiis.exe, 28: aspnet_regsql.exe, 29: Aspnet_regsql.exe.config, 30: aspnet_state.exe, 31: aspnet_state_perf.h, 32: aspnet_state_perf.ini, 33: aspnet_wp.exe, 34: big5.nlp, 35: bopomofo.nlp, 36: CasPol.exe, 37: caspol.exe.config, 38: CLR.mof, 39: CLR.mof.uninstall, 40: CONFIG, 41: CONFIG(2), 42: CORPerfMonExt.dll, 43: CORPerfMonSymbols.h, 44: corperfmonsymbols.ini, 45: csc.exe, 46: csc.exe.config, 47: csc.rsp, 48: cscomp.dll, 49: cscompmgd.dll, 50: Culture.dll, 51: CustomMarshalers.dll, 52: cvtres.exe, 53: dfdll.dll, 54: dfsvc.exe, 55: diasymreader.dll, 56: dv_aspnetmmc.chm, 57: EventLogMessages.dll, 58: fr, 59: fr(2), 60: fr(3), 61: fusion.dll, 62: GAC, 63: IEExec.exe, 64: ieexec.exe.config, 65: IEExecRemote.dll, 66: IEHost.dll, 67: IIEHost.dll, 68: ilasm.exe, 69: ilasm.exe.config, 70: InstallCommon.sql, 71: InstallMembership.sql, 72: InstallPersistSqlState.sql, 73: InstallPersonalization.sql, 74: InstallProfile.SQL, 75: InstallRoles.sql, 76: InstallSqlState.sql, 77: InstallSqlStateTemplate.sql, 78: InstallUtil.exe, 79: InstallUtilLib.dll, 80: InstallWebEventSqlProvider.sql, 81: ISymWrapper.dll, 82: jsc.exe, 83: jsc.exe.config, 84: ksc.nlp, 85: Microsoft.Build.Engine.dll, 86: Microsoft.Build.Framework.dll, 87: Microsoft.Build.Tasks.dll, 88: Microsoft.Build.Utilities.dll, 89: Microsoft.Build.xsd, 90: Microsoft.Common.targets, 91: Microsoft.Common.Tasks, 92: Microsoft.CSharp.targets, 93: Microsoft.JScript.dll, 94: Microsoft.JScript.tlb, 95: Microsoft.VisualBasic.Compatibility.Data.dll, 96: Microsoft.VisualBasic.Compatibility.dll, 97: Microsoft.VisualBasic.dll, 98: Microsoft.VisualBasic.targets, 99: Microsoft.VisualBasic.Vsa.dll, 100: Microsoft.VisualC.Dll, 101: Microsoft.Vsa.dll, 102: Microsoft.Vsa.tlb, 103: Microsoft.Vsa.Vb.CodeDOMProcessor.dll, 104: Microsoft.Vsa.Vb.CodeDOMProcessor.tlb, 105: Microsoft.WinFX.targets, 106: Microsoft_VsaVb.dll, 107: MmcAspExt.dll, 108: MSBuild, 109: MSBuild(2), 110: MSBuild.exe, 111: msbuild.exe.config, 112: MSBuild.rsp, 113: mscordacwks.dll, 114: mscordbc.dll, 115: mscordbi.dll, 116: mscoree.tlb, 117: mscorie.dll, 118: mscorjit.dll, 119: mscorld.dll, 120: mscorlib.dll, 121: mscorlib.tlb, 122: mscorpe.dll, 123: mscorrc.dll, 124: mscorsec.dll, 125: mscorsn.dll, 126: mscorsvc.dll, 127: mscorsvw.exe, 128: mscortim.dll, 129: mscorwks.dll, 130: MUI, 131: ngen.exe, 132: ngen.log, 133: ngen_service.log, 134: normalization.dll, 135: normidna.nlp, 136: normnfc.nlp, 137: normnfd.nlp, 138: normnfkc.nlp, 139: normnfkd.nlp, 140: PerfCounter.dll, 141: peverify.dll, 142: prc.nlp, 143: prcp.nlp, 144: RedistList, 145: RedistList(2), 146: RegAsm.exe, 147: regasm.exe.config, 148: RegSvcs.exe, 149: regsvcs.exe.config, 150: regtlibv12.exe, 151: sbscmp20_mscorlib.dll, 152: shfusion.chm, 153: shfusion.dll, 154: ShFusRes.dll, 155: sortkey.nlp, 156: sorttbls.nlp, 157: SOS.dll, 158: SubsetList, 159: SubsetList(2), 160: sysglobl.dll, 161: System.configuration.dll, 162: System.Configuration.Install.dll, 163: System.Data.dll, 164: System.Data.OracleClient.dll, 165: System.Data.SqlXml.dll, 166: System.Deployment.dll, 167: System.Design.dll, 168: System.DirectoryServices.dll, 169: System.DirectoryServices.Protocols.dll, 170: System.dll, 171: System.Drawing.Design.dll, 172: System.Drawing.dll, 173: System.Drawing.tlb, 174: System.EnterpriseServices.dll, 175: System.EnterpriseServices.Thunk.dll, 176: System.EnterpriseServices.tlb, 177: System.EnterpriseServices.Wrapper.dll, 178: System.Management.dll, 179: System.Messaging.dll, 180: System.Runtime.Remoting.dll, 181: System.Runtime.Serialization.Formatters.Soap.dll, 182: System.Security.dll, 183: System.ServiceProcess.dll, 184: System.tlb, 185: System.Transactions.dll, 186: System.Web.dll, 187: System.Web.Mobile.dll, 188: System.Web.RegularExpressions.dll, 189: System.Web.Services.dll, 190: System.Web.tlb, 191: System.Windows.Forms.dll, 192: System.Windows.Forms.tlb, 193: System.XML.dll, 194: Temporary ASP.NET Files, 195: TLBREF.DLL, 196: UninstallCommon.sql, 197: UninstallMembership.sql, 198: UninstallPersistSqlState.sql, 199: UninstallPersonalization.sql, 200: UnInstallProfile.SQL, 201: UninstallRoles.sql, 202: UninstallSqlState.sql, 203: UninstallSqlStateTemplate.sql, 204: UninstallWebEventSqlProvider.sql, 205: vbc.exe, 206: vbc.exe.config, 207: vbc.rsp, 208: vsavb7.olb, 209: VsaVb7rt.dll, 210: webengine.dll, 211: WMINet_Utils.dll, 212: xjis.nlp, 213: XPThemes.manifest, 214: _DataOracleClientPerfCounters_shared12_neutral.h, 215: _DataOracleClientPerfCounters_shared12_neutral.ini, 216: _DataPerfCounters.h, 217: _DataPerfCounters.ini, 218: _dataperfcounters_shared12_neutral.h, 219: _dataperfcounters_shared12_neutral.ini, 220: _NetworkingPerfCounters.h, 221: _Networkingperfcounters.ini 13:39:12,5430753 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727 NO MORE FILES 13:39:12,5431287 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727 SUCCESS 13:39:12,5432502 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5433334 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG SUCCESS 0: ., 1: .., 2: Browsers, 3: machine.config, 4: web.config, 5: web_hightrust.config, 6: web_lowtrust.config, 7: web_mediumtrust.config, 8: web_minimaltrust.config 13:39:12,5434814 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG NO MORE FILES 13:39:12,5435560 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG SUCCESS 13:39:12,5437280 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5438119 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr SUCCESS 0: ., 1: .., 2: Accessibility.xml, 3: aspnetmmcext.resources.dll, 4: AspNetMMCExt.xml, 5: aspnet_compiler.resources.dll, 6: aspnet_rc.dll, 7: aspnet_regbrowsers.resources.dll, 8: aspnet_regsql.resources.dll, 9: caspol.resources.dll, 10: cscompmgd.xml, 11: CustomMarshalers.xml, 12: IEExecRemote.xml, 13: IEHost.xml, 14: IIEHost.xml, 15: InstallUtil.resources.dll, 16: ISymWrapper.xml, 17: JSC.Resources.dll, 18: Microsoft.Build.Engine.resources.dll, 19: Microsoft.Build.Engine.xml, 20: Microsoft.Build.Framework.xml, 21: Microsoft.Build.Tasks.resources.dll, 22: Microsoft.Build.Tasks.xml, 23: Microsoft.Build.Utilities.Resources.dll, 24: Microsoft.Build.Utilities.xml, 25: Microsoft.JScript.Resources.dll, 26: Microsoft.JScript.xml, 27: Microsoft.VisualBasic.Compatibility.Data.xml, 28: Microsoft.VisualBasic.Compatibility.xml, 29: Microsoft.VisualBasic.resources.dll, 30: Microsoft.VisualBasic.Vsa.xml, 31: Microsoft.VisualBasic.xml, 32: Microsoft.VisualC.xml, 33: Microsoft.Vsa.Vb.CodeDOMProcessor.xml, 34: Microsoft.Vsa.xml, 35: Microsoft_VsaVb.xml, 36: MSBuild.resources.dll, 37: mscorlib.Resources.dll, 38: mscorlib.xml, 39: mscorrc.dll, 40: Regasm.resources.dll, 41: shfusion.chm, 42: ShFusRes.dll, 43: sysglobl.resources.dll, 44: sysglobl.xml, 45: System.Configuration.Install.Resources.dll, 46: System.Configuration.Install.xml, 47: System.Configuration.resources.dll, 48: System.Configuration.xml, 49: System.Data.OracleClient.resources.dll, 50: System.Data.OracleClient.xml, 51: System.Data.Resources.dll, 52: system.data.sqlxml.resources.dll, 53: System.Data.SqlXml.xml, 54: System.Data.xml, 55: System.Deployment.resources.dll, 56: System.Deployment.xml, 57: System.Design.Resources.dll, 58: System.Design.xml, 59: System.DirectoryServices.Protocols.resources.dll, 60: System.DirectoryServices.Protocols.xml, 61: System.DirectoryServices.Resources.dll, 62: System.DirectoryServices.xml, 63: System.Drawing.Design.Resources.dll, 64: System.Drawing.Design.xml, 65: System.Drawing.Resources.dll, 66: System.Drawing.xml, 67: System.EnterpriseServices.Resources.dll, 68: System.EnterpriseServices.xml, 69: System.Management.Resources.dll, 70: System.Management.xml, 71: System.Messaging.Resources.dll, 72: System.Messaging.xml, 73: system.Resources.dll, 74: System.Runtime.Remoting.Resources.dll, 75: System.Runtime.Remoting.xml, 76: System.Runtime.Serialization.Formatters.Soap.Resources.dll, 77: System.Runtime.Serialization.Formatters.Soap.xml, 78: System.Security.Resources.dll, 79: System.Security.xml, 80: System.ServiceProcess.Resources.dll, 81: System.ServiceProcess.xml, 82: System.Transactions.resources.dll, 83: System.Transactions.xml, 84: System.Web.Mobile.resources.dll, 85: System.Web.Mobile.xml, 86: System.Web.RegularExpressions.xml, 87: System.Web.Resources.dll, 88: System.Web.Services.Resources.dll, 89: System.Web.Services.xml, 90: System.Web.xml, 91: System.Windows.Forms.Resources.dll, 92: System.Windows.Forms.xml, 93: System.xml, 94: System.xml.Resources.dll, 95: System.Xml.xml 13:39:12,5440647 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr NO MORE FILES 13:39:12,5441379 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr SUCCESS 13:39:12,5443006 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\V4.0.30319 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5443547 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS 0: ., 1: .., 2: 1033, 3: 1036, 4: 1036(2), 5: Accessibility.dll, 6: AddInProcess.exe, 7: AddInProcess.exe.config, 8: AddInProcess32.exe, 9: AddInProcess32.exe.config, 10: AddInUtil.exe, 11: AddInUtil.exe.config, 12: AdoNetDiag.dll, 13: adonetdiag.mof, 14: adonetdiag.mof.uninstall, 15: alink.dll, 16: AppLaunch.exe, 17: applaunch.exe.config, 18: ASP(2).NETWebAdminFiles, 19: ASP.NETWebAdminFiles, 20: Aspnet.config, 21: aspnet.mof, 22: aspnet.mof.uninstall, 23: AspNetMMCExt.dll, 24: aspnet_compiler.exe, 25: aspnet_filter.dll, 26: aspnet_isapi.dll, 27: Aspnet_perf.dll, 28: aspnet_perf.h, 29: aspnet_perf.ini, 30: aspnet_perf2.ini, 31: aspnet_rc.dll, 32: aspnet_regbrowsers.exe, 33: aspnet_regiis.exe, 34: aspnet_regsql.exe, 35: aspnet_state.exe, 36: aspnet_state_perf.h, 37: aspnet_state_perf.ini, 38: aspnet_wp.exe, 39: CasPol.exe, 40: caspol.exe.config, 41: clr.dll, 42: CLR.mof, 43: CLR.mof.uninstall, 44: clrjit.dll, 45: ComSvcConfig.exe, 46: Config, 47: Config(2), 48: CORPerfMonExt.dll, 49: CORPerfMonSymbols.h, 50: corperfmonsymbols.ini, 51: csc.exe, 52: csc.exe.config, 53: csc.rsp, 54: Culture.dll, 55: CustomMarshalers.dll, 56: cvtres.exe, 57: cvtres.exe.config, 58: DataSvcUtil.exe, 59: DataSvcUtil.exe.config, 60: default.win32manifest, 61: dfdll.dll, 62: dfsvc.exe, 63: dfsvc.exe.config, 64: diasymreader.dll, 65: dv_aspnetmmc.chm, 66: EdmGen.exe, 67: EventLogMessages.dll, 68: FileTracker.dll, 69: fr, 70: fr(2), 71: fusion.dll, 72: ilasm.exe, 73: ilasm.exe.config, 74: InstallCommon.sql, 75: InstallMembership.sql, 76: InstallPersistSqlState.sql, 77: InstallPersonalization.sql, 78: InstallProfile.SQL, 79: InstallRoles.sql, 80: InstallSqlState.sql, 81: InstallSqlStateTemplate.sql, 82: InstallUtil.exe, 83: InstallUtil.exe.config, 84: InstallUtilLib.dll, 85: InstallWebEventSqlProvider.sql, 86: ISymWrapper.dll, 87: jsc.exe, 88: jsc.exe.config, 89: locale.nlp, 90: Microsoft.Build.Conversion.v4.0.dll, 91: Microsoft.Build.dll, 92: Microsoft.Build.Engine.dll, 93: Microsoft.Build.Framework.dll, 94: Microsoft.Build.Tasks.v4.0.dll, 95: Microsoft.Build.Utilities.v4.0.dll, 96: Microsoft.Build.xsd, 97: Microsoft.Common.OverrideTasks, 98: Microsoft.Common.targets, 99: Microsoft.Common.Tasks, 100: Microsoft.CSharp.dll, 101: Microsoft.CSharp.targets, 102: Microsoft.Data.Entity.Build.Tasks.dll, 103: Microsoft.Data.Entity.targets, 104: Microsoft.JScript.dll, 105: Microsoft.JScript.tlb, 106: Microsoft.NETFramework.props, 107: Microsoft.NETFramework.targets, 108: Microsoft.Transactions.Bridge.dll, 109: Microsoft.Transactions.Bridge.Dtc.dll, 110: Microsoft.VisualBasic.Activities.Compiler.dll, 111: Microsoft.VisualBasic.Compatibility.Data.dll, 112: Microsoft.VisualBasic.Compatibility.dll, 113: Microsoft.VisualBasic.dll, 114: Microsoft.VisualBasic.targets, 115: Microsoft.VisualC.Dll, 116: Microsoft.VisualC.STLCLR.dll, 117: Microsoft.Windows.ApplicationServer.Applications.man, 118: Microsoft.WinFx.targets, 119: Microsoft.Workflow.Compiler.exe, 120: Microsoft.Workflow.Compiler.exe.config, 121: Microsoft.Xaml.targets, 122: MmcAspExt.dll, 123: MOF, 124: MOF(2), 125: MSBuild, 126: MSBuild(2), 127: MSBuild.exe, 128: msbuild.exe.config, 129: MSBuild.rsp, 130: mscordacwks.dll, 131: mscordbi.dll, 132: mscoree.tlb, 133: mscoreei.dll, 134: mscoreeis.dll, 135: mscorlib.dll, 136: mscorlib.tlb, 137: mscorpe.dll, 138: mscorpehost.dll, 139: mscorrc.dll, 140: mscorsecimpl.dll, 141: mscorsn.dll, 142: mscorsvc.dll, 143: mscorsvw.exe, 144: MUI, 145: MUI(2), 146: netmemorycache.h, 147: netmemorycache.ini, 148: ngen.exe, 149: ngen.log, 150: ngen_service.log, 151: nlssorting.dll, 152: normalization.dll, 153: normidna.nlp, 154: normnfc.nlp, 155: normnfd.nlp, 156: normnfkc.nlp, 157: normnfkd.nlp, 158: PerfCounter.dll, 159: PerfCounters.h, 160: PerfCounters.ini, 161: peverify.dll, 162: RegAsm.exe, 163: regasm.exe.config, 164: RegSvcs.exe, 165: regsvcs.exe.config, 166: regtlibv12.exe, 167: SbsNclPerf.dll, 168: ServiceModelEvents.dll, 169: ServiceModelInstallRC.dll, 170: ServiceModelReg.exe, 171: ServiceModelRegUI.dll, 172: ServiceMonikerSupport.dll, 173: SetupCache, 174: SMDiagnostics.dll, 175: SMSvcHost.exe, 176: SMSvcHost.exe.config, 177: sortdefault.nlp, 178: SOS.dll, 179: SQL, 180: SQL(2), 181: sysglobl.dll, 182: System.Activities.Core.Presentation.dll, 183: System.Activities.dll, 184: System.Activities.DurableInstancing.dll, 185: System.Activities.Presentation.dll, 186: System.AddIn.Contract.dll, 187: System.AddIn.dll, 188: System.ComponentModel.Composition.dll, 189: System.ComponentModel.DataAnnotations.dll, 190: System.configuration.dll, 191: System.Configuration.Install.dll, 192: System.Core.dll, 193: System.Data.DataSetExtensions.dll, 194: System.Data.dll, 195: System.Data.Entity.Design.dll, 196: System.Data.Entity.dll, 197: System.Data.Linq.dll, 198: System.Data.OracleClient.dll, 199: System.Data.Services.Client.dll, 200: System.Data.Services.Design.dll, 201: System.Data.Services.dll, 202: System.Data.SqlXml.dll, 203: System.Deployment.dll, 204: System.Design.dll, 205: System.Device.dll, 206: System.DirectoryServices.AccountManagement.dll, 207: System.DirectoryServices.dll, 208: System.DirectoryServices.Protocols.dll, 209: System.dll, 210: System.Drawing.Design.dll, 211: System.Drawing.dll, 212: System.Drawing.tlb, 213: System.Dynamic.dll, 214: System.EnterpriseServices.dll, 215: System.EnterpriseServices.Thunk.dll, 216: System.EnterpriseServices.tlb, 217: System.EnterpriseServices.Wrapper.dll, 218: System.IdentityModel.dll, 219: System.IdentityModel.Selectors.dll, 220: System.IO.Log.dll, 221: System.Management.dll, 222: System.Management.Instrumentation.dll, 223: System.Messaging.dll, 224: System.Net.dll, 225: System.Numerics.dll, 226: System.Runtime.Caching.dll, 227: System.Runtime.DurableInstancing.dll, 228: System.Runtime.Remoting.dll, 229: System.Runtime.Serialization.dll, 230: System.Runtime.Serialization.Formatters.Soap.dll, 231: System.Security.dll, 232: System.ServiceModel.Activation.dll, 233: System.ServiceModel.Activities.dll, 234: System.ServiceModel.Channels.dll, 235: System.ServiceModel.Discovery.dll, 236: System.ServiceModel.dll, 237: System.ServiceModel.Routing.dll, 238: System.ServiceModel.ServiceMoniker40.dll, 239: System.ServiceModel.WasHosting.dll, 240: System.ServiceModel.Web.dll, 241: System.ServiceProcess.dll, 242: System.tlb, 243: System.Transactions.dll, 244: System.Web.Abstractions.dll, 245: System.Web.ApplicationServices.dll, 246: System.Web.DataVisualization.Design.dll, 247: System.Web.DataVisualization.dll, 248: System.Web.dll, 249: System.Web.DynamicData.Design.dll, 250: System.Web.DynamicData.dll, 251: System.Web.Entity.Design.dll, 252: System.Web.Entity.dll, 253: System.Web.Extensions.Design.dll, 254: System.Web.Extensions.dll, 255: System.Web.Mobile.dll, 256: System.Web.RegularExpressions.dll, 257: System.Web.Routing.dll, 258: System.Web.Services.dll, 259: System.Web.tlb, 260: System.Windows.Forms.DataVisualization.Design.dll, 261: System.Windows.Forms.DataVisualization.dll, 262: System.Windows.Forms.dll, 263: System.Windows.Forms.tlb, 264: System.Workflow.Activities.dll, 265: System.Workflow.ComponentModel.dll, 266: System.Workflow.Runtime.dll, 267: System.WorkflowServices.dll, 268: System.Xaml.dll, 269: System.Xaml.Hosting.dll, 270: System.XML.dll, 271: System.Xml.Linq.dll, 272: Temporary ASP.NET Files, 273: TLBREF.DLL, 274: UninstallCommon.sql, 275: UninstallMembership.sql, 276: UninstallPersistSqlState.sql, 277: UninstallPersonalization.sql, 278: UnInstallProfile.SQL, 279: UninstallRoles.sql, 280: UninstallSqlState.sql, 281: UninstallSqlStateTemplate.sql, 282: UninstallWebEventSqlProvider.sql, 283: vbc.exe, 284: vbc.exe.config, 285: vbc.rsp, 286: webengine.dll, 287: webengine4.dll, 288: WMINet_Utils.dll, 289: Workflow.Targets, 290: Workflow.VisualBasic.Targets, 291: WPF, 292: WPF(2), 293: WsatConfig.exe, 294: XamlBuildTask.dll, 295: XPThemes.manifest 13:39:12,5446089 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS 0: _DataOracleClientPerfCounters_shared12_neutral.h, 1: _DataOracleClientPerfCounters_shared12_neutral.ini, 2: _DataPerfCounters.h, 3: _DataPerfCounters.ini, 4: _dataperfcounters_shared12_neutral.h, 5: _dataperfcounters_shared12_neutral.ini, 6: _NetworkingPerfCounters.h, 7: _Networkingperfcounters.ini, 8: _NetworkingPerfCounters_v2.h, 9: _Networkingperfcounters_v2.ini, 10: _ServiceModelEndpointPerfCounters.h, 11: _ServiceModelEndpointPerfCounters.ini, 12: _ServiceModelOperationPerfCounters.h, 13: _ServiceModelOperationPerfCounters.ini, 14: _ServiceModelServicePerfCounters.h, 15: _ServiceModelServicePerfCounters.ini, 16: _SMSvcHostPerfCounters.h, 17: _SMSvcHostPerfCounters.ini, 18: _TransactionBridgePerfCounters.h, 19: _TransactionBridgePerfCounters.ini 13:39:12,5446936 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 NO MORE FILES 13:39:12,5447544 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS 13:39:12,5448446 SexyCity.exe 564 CreateFile C:\WINDOWS\REGISTRATION SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5448964 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Registration SUCCESS 0: ., 1: .., 2: CRMLog, 3: R000000000018.clb, 4: R000000000019.clb, 5: R00000000001a.clb, 6: R00000000001b.clb, 7: R00000000001c.clb, 8: {02D4B3F1-FD88-11D1-960D-00805FC79235}.{2189115F-7036-4008-A925-C41EFDAA6550}.crmlog 13:39:12,5449718 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Registration NO MORE FILES 13:39:12,5451076 SexyCity.exe 564 CloseFile C:\WINDOWS\Registration SUCCESS 13:39:12,5452235 SexyCity.exe 564 CreateFile C:\WINDOWS\system32 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5453029 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 SUCCESS 0: ., 1: .., 2: $winnt$.inf, 3: 0373cc79-.txt, 4: 1025, 5: 1028, 6: 1031, 7: 1033, 8: 1036, 9: 1037, 10: 1041, 11: 1042, 12: 1054, 13: 12520437.cpx, 14: 12520850.cpx, 15: 2052, 16: 3076, 17: 3com_dmi, 18: 3ivx.dll, 19: 3ivxDSDecoder.ax, 20: 3ivxDSMediaSplitter.ax, 21: 6to4svc.dll, 22: a15.tbl, 23: a234.tbl, 24: a3d.dll, 25: aaaamon.dll, 26: aaclient.dll, 27: ac3acm.acm, 28: access.cpl, 29: acctres.dll, 30: accwiz.exe, 31: acelpdec.ax, 32: acledit.dll, 33: aclui.dll, 34: acode.tbl, 35: activeds.dll, 36: activeds.tlb, 37: actmovie.exe, 38: actskin4.ocx, 39: actskn43.ocx, 40: actxprxy.dll, 41: admparse.dll, 42: Adobe, 43: adptif.dll, 44: adsldp.dll, 45: adsldpc.dll, 46: adsmsext.dll, 47: adsnt.dll, 48: advapi32.dll, 49: advpack.dll, 50: advpack.dll.mui, 51: AgCPanelFrench.dll, 52: AgCPanelGerman.dll, 53: AgCPanelJapanese.dll, 54: AgCPanelKorean.dll, 55: AgCPanelPortugese.dll, 56: AgCPanelSimplifiedChinese.dll, 57: AgCPanelSpanish.dll, 58: AgCPanelSwedish.dll, 59: AgCPanelTraditionalChinese.dll, 60: AGEIA, 61: ahui.exe, 62: alg.exe, 63: alrsvc.dll, 64: amcompat.tlb, 65: amstream.dll, 66: ansi.sys, 67: apcups.dll, 68: append.exe, 69: apphelp.dll, 70: appwiz.cpl, 71: arp.exe, 72: arphr.tbl, 73: arptr.tbl, 74: array30.tab, 75: arrayhw.tab, 76: asctrls.ocx, 77: asferror.dll, 78: aspnet_counters.dll, 79: asw35.tmp, 80: asw44.tmp, 81: aswBoot.exe, 82: asycfilt.dll, 83: asycfilt.dll.tmp, 84: at.exe, 85: atkctrs.dll, 86: atl.dll, 87: atl71.dll, 88: ATL80.dll, 89: atmadm.exe, 90: atmfd.dll, 91: atmlib.dll, 92: atmpvcno.dll, 93: atrace.dll, 94: attrib.exe, 95: audiodev.dll, 96: audiosrv.dll, 97: auditusr.exe, 98: authz.dll, 99: autochk.exe, 100: autoconv.exe, 101: autodisc.dll, 102: AUTOEXEC.NT, 103: autofmt.exe, 104: autolfn.exe, 105: AvastSS.scr, 106: avicap.dll, 107: avicap32.dll, 108: avifil32.dll, 109: avifile.dll, 110: avisynth.dll, 111: avmeter.dll, 112: avtapi.dll, 113: avwav.dll, 114: axaltocm.dll, 115: basecsp.dll, 116: basesrv.dll, 117: bassenc.dll, 118: bass_fx.dll, 119: batmeter.dll, 120: batt.dll, 121: bcsprsrc.dll, 122: bidispl.dll, 123: big5.nls, 124: bios1.rom, 125: bios4.rom, 126: bitsprx2.dll, 127: bitsprx3.dll, 128: blackbox.dll, 129: blastcln.exe, 130: bootok.exe, 131: bootvid.dll, 132: bootvrfy.exe, 133: bopomofo.nls, 134: bopomofo.uce, 135: browselc.dll, 136: browser.dll, 137: browseui.dll, 138: browsewm.dll, 139: bthci.dll, 140: bthprops.cpl, 141: bthserv.dll, 142: btpanui.dll, 143: cabinet.dll, 144: cabview.dll, 145: cacls.exe, 146: calc.exe, 147: camocx.dll, 148: capesnpn.dll, 149: cards.dll, 150: CatRoot, 151: CatRoot2, 152: CatRoot_bak, 153: catsrv.dll, 154: catsrvps.dll, 155: catsrvut.dll, 156: ccfgnt.dll, 157: cdfview.dll, 158: cdm.dll, 159: cdmodem.dll, 160: cdosys.dll, 161: certcli.dll, 162: certmgr.dll, 163: certmgr.msc, 164: cewmdm.dll, 165: cfgbkend.dll, 166: cfgmgr32.dll, 167: chajei.ime, 168: charmap.exe, 169: Chaînes.scf, 170: chcp.com, 171: chkdsk.exe, 172: chkntfs.exe, 173: chsbrkr.dll, 174: chtbrkr.dll, 175: ciadmin.dll, 176: ciadv.msc, 177: cic.dll, 178: cidaemon.exe, 179: CINTLGNT.IME, 180: ciodm.dll, 181: cisvc.exe, 182: ckcnv.exe, 183: clb.dll, 184: clbcatex.dll, 185: clbcatq.dll, 186: cleanmgr.exe, 187: CleanUp.exe, 188: cliconf.chm, 189: cliconfg.dll, 190: cliconfg.exe, 191: cliconfg.rll, 192: clipbrd.exe, 193: clipsrv.exe, 194: clusapi.dll, 195: cmcfg32.dll, 196: CMCT2FR.DLL, 197: cmd.exe, 198: cmdial32.dll, 199: cmdl32.exe, 200: CMDLGFR.DLL, 201: CmdLineExt.dll, 202: CmdLineExt03.dll, 203: cmmgr32.hlp, 204: cmmon32.exe, 205: cmos.ram, 206: cmpbk32.dll, 207: cmprops.dll, 208: cmsetACL.dll, 209: cmstp.exe, 210: cmutil.dll, 211: cnbjmon.dll, 212: cnetcfg.dll, 213: cnvfat.dll, 214: colbact.dll, 215: Com, 216: comaddin.dll, 217: comcat.dll, 218: COMCT232.OCX, 219: comct332.ocx, 220: comctl32.dll, 221: comctl32.ocx, 222: comdlg32.dll, 223: comdlg32.oca, 224: COMDLG32.OCX, 225: comm.drv, 226: COMMAND.COM, 227: command.com.bak, 228: commdlg.dll, 229: comp.exe, 230: compact.exe, 231: compatUI.dll, 232: compmgmt.msc, 233: compobj.dll, 234: compstui.dll, 235: comrepl.dll, 236: comres.dll, 237: comsnap.dll, 238: comsvcs.dll, 239: comuid.dll, 240: config, 241: CONFIG.NT, 242: config.nt.bak, 243: confmsp.dll, 244: conime.exe, 245: console.dll, 246: control.exe, 247: ControlSubX.ocx, 248: convert.exe, 249: corpol.dll, 250: country.sys, 251: cpuinf32.dll, 252: credui.dll, 253: crtdll.dll, 254: crypt32.dll, 255: cryptdlg.dll, 256: cryptdll.dll, 257: cryptext.dll, 258: cryptnet.dll, 259: cryptsvc.dll, 260: cryptui.dll, 261: cscdll.dll, 262: cscript.exe, 263: cscui.dll, 264: csrsrv.dll, 265: csrss.exe, 266: csseqchk.dll, 267: ctfmon.exe, 268: ctl3d32.dll, 269: ctl3dv2.dll, 270: ctype.nls, 271: c_037.nls, 272: c_10000.nls, 273: c_10001.nls, 274: c_10002.nls, 275: c_10003.nls, 276: c_10004.nls, 277: c_10005.nls, 278: c_10006.nls, 279: c_10007.nls, 280: c_10008.nls, 281: c_10010.nls, 282: c_10017.nls, 283: c_10021.nls, 284: c_10029.nls, 285: c_10079.nls, 286: c_10081.nls, 287: c_10082.nls, 288: c_1026.nls, 289: c_1250.nls, 290: c_1251.nls, 291: c_1252.nls, 292: c_1253.nls, 293: c_1254.nls, 294: c_1255.nls, 295: c_1256.nls, 296: c_1257.nls, 297: c_1258.nls, 298: c_1361.nls, 299: c_20000.nls, 300: c_20127.nls, 301: c_20261.nls, 302: c_20290.nls, 303: c_20866.nls, 304: c_20905.nls, 305: c_20932.nls, 306: c_20936.nls, 307: c_20949.nls, 308: c_21027.nls, 309: c_21866.nls, 310: c_28591.nls, 311: c_28592.nls, 312: c_28593.nls, 313: C_28594.NLS, 314: C_28595.NLS, 315: C_28596.NLS, 316: C_28597.NLS, 317: c_28598.nls, 318: c_28599.nls, 319: c_28603.nls, 320: c_28605.nls, 321: c_437.nls, 322: c_500.nls, 323: c_708.nls, 324: c_720.nls, 325: c_737.nls, 326: c_775.nls, 327: c_850.nls, 328: c_852.nls, 329: c_855.nls, 330: c_857.nls, 331: c_860.nls, 332: c_861.nls, 333: c_862.nls, 334: c_863.nls, 335: c_864.nls, 336: c_865.nls, 337: c_866.nls, 338: c_869.nls, 339: c_874.nls, 340: c_875.nls, 341: c_932.nls, 342: c_936.nls, 343: c_949.nls, 344: c_950.nls, 345: c_g18030.dll, 346: c_is2022.dll, 347: c_iscii.dll, 348: d3d8.dll, 349: d3d8thk.dll, 350: d3d9.dll, 351: D3DCompiler_33.dll, 352: D3DCompiler_34.dll, 353: D3DCompiler_35.dll, 354: D3DCompiler_36.dll, 355: D3DCompiler_37.dll, 356: D3DCompiler_38.dll, 357: D3DCompiler_39.dll, 358: D3DCompiler_40.dll, 359: D3DCompiler_41.dll, 360: D3DCompiler_42.dll, 361: D3DCompiler_43.dll, 362: d3dcsx_42.dll, 363: d3dcsx_43.dll, 364: d3dim.dll, 365: d3dim700.dll, 366: d3dpmesh.dll, 367: d3dramp.dll, 368: d3drm.dll, 369: d3dx10_33.dll, 370: d3dx10_34.dll, 371: d3dx10_35.dll, 372: d3dx10_36.dll, 373: d3dx10_37.dll, 374: d3dx10_38.dll, 375: d3dx10_39.dll, 376: d3dx10_40.dll, 377: d3dx10_41.dll, 378: d3dx10_42.dll, 379: d3dx10_43.dll, 380: d3dx11_42.dll, 381: d3dx11_43.dll, 382: d3dx9_24.dll, 383: d3dx9_25.dll, 384: d3dx9_26.dll, 385: d3dx9_27.dll, 386: d3dx9_28.dll, 387: d3dx9_29.dll, 388: d3dx9_30.dll, 389: d3dx9_31.dll, 390: d3dx9_32.dll, 391: d3dx9_33.dll, 392: d3dx9_34.dll, 393: d3dx9_35.dll, 394: d3dx9_36.dll, 395: D3DX9_37.dll, 396: D3DX9_38.dll, 397: D3DX9_39.dll, 398: D3DX9_40.dll, 399: D3DX9_41.dll, 400: D3DX9_42.dll, 401: D3DX9_43.dll, 402: d3dxof.dll, 403: danim.dll, 404: dataclen.dll, 405: datime.dll, 406: davclnt.dll, 407: daxctle.ocx, 408: dayi.ime, 409: dayiphr.tbl, 410: dayiptr.tbl, 411: dbgeng.dll, 412: dbghelp.dll, 413: dbmsrpcn.dll, 414: dbnetlib.dll, 415: dbnmpntw.dll, 416: Dcache.bin, 417: dciman32.dll, 418: dcomcnfg.exe, 419: ddeml.dll, 420: ddeshare.exe, 421: ddraw.dll, 422: ddrawex.dll, 423: debug.exe, 424: defrag.exe, 425: deployJava1.dll, 426: desk.cpl, 427: deskadp.dll, 428: deskmon.dll, 429: deskperf.dll, 430: devenum.dll, 431: devil.dll, 432: devmgmt.msc, 433: devmgr.dll, 434: dfrg.msc, 435: dfrgfat.exe 13:39:12,5455431 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 SUCCESS 0: dfrgntfs.exe, 1: dfrgres.dll, 2: dfrgsnap.dll, 3: dfrgui.dll, 4: dfshim.dll, 5: dfsshlex.dll, 6: dgnet.dll, 7: dgrpsetu.dll, 8: dgsetup.dll, 9: dhcp, 10: dhcpcsvc.dll, 11: dhcpmon.dll, 12: dhcpsapi.dll, 13: diactfrm.dll, 14: diantz.exe, 15: digest.dll, 16: dimap.dll, 17: dinput.dll, 18: dinput8.dll, 19: DirectX, 20: diskcomp.com, 21: diskcopy.com, 22: diskcopy.dll, 23: diskmgmt.msc, 24: diskpart.exe, 25: diskperf.exe, 26: dispex.dll, 27: DivXc32.dll, 28: DivXc32f.dll, 29: DivXCodecVersionChecker.exe, 30: DivX_c32.ax, 31: dllcache, 32: dllhost.exe, 33: dllhst3g.exe, 34: dmadmin.exe, 35: dmband.dll, 36: dmcompos.dll, 37: dmconfig.dll, 38: dmdlgs.dll, 39: dmdskmgr.dll, 40: dmdskres.dll, 41: dmime.dll, 42: dmintf.dll, 43: dmloader.dll, 44: dmocx.dll, 45: dmremote.exe, 46: dmscript.dll, 47: dmserver.dll, 48: dmstyle.dll, 49: dmsynth.dll, 50: dmusic.dll, 51: dmutil.dll, 52: dmview.ocx, 53: dns-sd.exe, 54: dnsapi.dll, 55: dnsrslvr.dll, 56: dnssd.dll, 57: docprop.dll, 58: docprop2.dll, 59: doskey.exe, 60: dosx.exe, 61: dpcdll.dll, 62: dpl100.dll, 63: dpl100.dll.manifest, 64: dplay.dll, 65: dplaysvr.exe, 66: dplayx.dll, 67: dpmodemx.dll, 68: dpnaddr.dll, 69: dpnet.dll, 70: dpnhpast.dll, 71: dpnhupnp.dll, 72: dpnlobby.dll, 73: dpnmodem.dll, 74: dpnsvr.exe, 75: dpnwsock.dll, 76: dpserial.dll, 77: dpu10.dll, 78: dpu11.dll, 79: dpufr.qm, 80: dpuGUI10.dll, 81: dpuGUI11.dll, 82: dpus11.dll, 83: dpv11.dll, 84: dpvacm.dll, 85: dpvoice.dll, 86: dpvsetup.exe, 87: dpvvox.dll, 88: dpwsock.dll, 89: dpwsockx.dll, 90: drivers, 91: drmclien.dll, 92: drmstor.dll, 93: drmupgds.exe, 94: drmv2clt.dll, 95: drprov.dll, 96: DRVSTORE, 97: drwatson.exe, 98: drwtsn32.exe, 99: ds16gt.dLL, 100: ds32gt.dll, 101: dsauth.dll, 102: dsdmo.dll, 103: dsdmoprp.dll, 104: dskquota.dll, 105: dskquoui.dll, 106: DSndUp.exe, 107: dsound.dll, 108: dsound.vxd, 109: dsound3d.dll, 110: dsprop.dll, 111: dsprpres.dll, 112: dsquery.dll, 113: dssec.dat, 114: dssec.dll, 115: dssenh.dll, 116: dsuiext.dll, 117: dswave.dll, 118: dtssource.ax, 119: dtu100.dll, 120: dtu100.dll.manifest, 121: dtu_fr.qm, 122: dumprep.exe, 123: duser.dll, 124: dvdplay.exe, 125: dvdupgrd.exe, 126: dwwin.exe, 127: dx7vb.dll, 128: dx8vb.dll, 129: dxdiag.exe, 130: dxdiagn.dll, 131: dxmasf.dll, 132: dxtmsft.dll, 133: dxtmsft3.dll, 134: dxtrans.dll, 135: dxva2.dll, 136: eax.dll, 137: edit.com, 138: edit.hlp, 139: edlin.exe, 140: ega.cpi, 141: eimisvxl.ini, 142: ElbyCDIO.dll, 143: els.dll, 144: embedded, 145: emptyregdb.dat, 146: en-us, 147: encapi.dll, 148: encdec.dll, 149: EPPICLocal_BP.cfg, 150: EPPICLocal_CF.cfg, 151: EPPICLocal_DU.cfg, 152: EPPICLocal_EN.cfg, 153: EPPICLocal_ES.cfg, 154: EPPICLocal_FR.cfg, 155: EPPICLocal_GE.cfg, 156: EPPICLocal_IT.cfg, 157: EPPICLocal_KO.cfg, 158: EPPICLocal_PT.cfg, 159: EPPICLocal_RU.cfg, 160: EPPICLocal_SC.cfg, 161: EPPICLocal_TC.cfg, 162: EPPicMgr.dll, 163: EPPICPattern1.dat, 164: EPPICPattern121.dat, 165: EPPICPattern131.dat, 166: EPPICPattern2.dat, 167: EPPICPattern3.dat, 168: EPPICPattern4.dat, 169: EPPICPattern5.dat, 170: EPPICPattern6.dat, 171: EPPICPresetData_DU.dat, 172: EPPICPresetData_EN.dat, 173: EPPICPresetData_ES.dat, 174: EPPICPresetData_GE.dat, 175: EPPICPresetData_IT.dat, 176: EPPICPrinterDB.dat, 177: EpPicPrt.dll, 178: EPSTP32U.EXE, 179: EqnClass.Dll, 180: ersvc.dll, 181: es.dll, 182: esent.dll, 183: esent97.dll, 184: esentprf.dll, 185: esentprf.hxx, 186: esentprf.ini, 187: esentutl.exe, 188: eudcedit.exe, 189: eula.txt, 190: eventcls.dll, 191: eventlog.dll, 192: eventvwr.exe, 193: eventvwr.msc, 194: evr.dll, 195: exe2bin.exe, 196: expand.exe, 197: export, 198: expsrv.dll, 199: extmgr.dll, 200: extrac32.exe, 201: exts.dll, 202: ezsidmv.dat, 203: E_DCINST.DLL, 204: E_FD4BCDE.DLL, 205: E_FLBCDE.DLL, 206: f3ahvoas.dll, 207: fastopen.exe, 208: faultrep.dll, 209: fc.exe, 210: feclient.dll, 211: ff_vfw.dll, 212: ff_vfw.dll.manifest, 213: filemgmt.dll, 214: find.exe, 215: findstr.exe, 216: finger.exe, 217: firewall.cpl, 218: fixmapi.exe, 219: fldrclnr.dll, 220: fltlib.dll, 221: fltmc.exe, 222: FM20.DLL, 223: FM20ENU.DLL, 224: FM20FRA.DLL, 225: fmifs.dll, 226: FNTCACHE.DAT, 227: fontext.dll, 228: fontsub.dll, 229: fontview.exe, 230: forcedos.exe, 231: format.com, 232: fr-fr, 233: framebuf.dll, 234: framedyn.dll, 235: freecell.exe, 236: fsmgmt.msc, 237: fsquirt.exe, 238: fsusd.dll, 239: fsutil.exe, 240: ftlx041e.dll, 241: ftp.exe, 242: ftsrch.dll, 243: fwcfg.dll, 244: g711codc.ax, 245: gb2312.uce, 246: gcdef.dll, 247: gdi+.tlb, 248: gdi.exe, 249: gdi32.dll, 250: gdiplus.dll, 251: GEARAspi.dll, 252: geo.nls, 253: getuname.dll, 254: GflAx.dll, 255: giveio.sys, 256: glmf32.dll, 257: glu32.dll, 258: GPhotos.scr, 259: gPhotoShow.scr, 260: gpkcsp.dll, 261: gpkrsrc.dll, 262: GplMpgDec.ax, 263: graftabl.com, 264: graphics.com, 265: graphics.pro, 266: grpconv.exe, 267: h323.tsp, 268: h323log.txt, 269: h323msp.dll, 270: hal.dll, 271: hccoin.dll, 272: HdAProp.dll, 273: HdAShCut.exe, 274: hdwwiz.cpl, 275: help.exe, 276: hhctrl.ocx, 277: hhsetup.dll, 278: hid.dll, 279: hidphone.tsp, 280: hidserv.dll, 281: himem.sys, 282: HLBButton6.ocx, 283: hlink.dll, 284: hnetcfg.dll, 285: hnetmon.dll, 286: hnetwiz.dll, 287: homepage.inf, 288: hostname.exe, 289: hotplug.dll, 290: hslwdprn.ini, 291: hticons.dll, 292: html.iec, 293: httpapi.dll, 294: htui.dll, 295: hypertrm.dll, 296: ias, 297: iasacct.dll, 298: iasads.dll, 299: iashlpr.dll, 300: iasnap.dll, 301: iaspolcy.dll, 302: iasrad.dll, 303: iasrecst.dll, 304: iassam.dll, 305: iassdo.dll, 306: iassvcs.dll, 307: icaapi.dll, 308: icardagt.exe, 309: icardie.dll, 310: icardres.dll, 311: icardres.dll.mui, 312: iccvid.dll, 313: icfgnt5.dll, 314: icm32.dll, 315: icmp.dll, 316: icmui.dll, 317: icrav03.rat, 318: icsxml, 319: icwdial.dll, 320: icwphbk.dll, 321: ideograf.uce, 322: idndl.dll, 323: idq.dll, 324: ie4uinit.exe, 325: IE7Eula.rtf, 326: ieakeng.dll, 327: ieaksie.dll, 328: ieakui.dll, 329: ieapfltr.dat, 330: ieapfltr.dll, 331: iedkcs32.dll, 332: ieencode.dll, 333: ieframe.dll, 334: ieframe.dll.mui, 335: iepeers.dll, 336: iernonce.dll, 337: iertutil.dll, 338: iesetup.dll, 339: ieudinit.exe, 340: ieui.dll, 341: ieuinit.inf, 342: iexpress.exe, 343: ifmon.dll, 344: ifsutil.dll, 345: ifxcardm.dll, 346: igmpagnt.dll, 347: ihivghkx.ini, 348: ils.dll, 349: imaadp32.acm, 350: imagehlp.dll, 351: ImagX7.dll, 352: ImagXpr7.dll, 353: ImagXR7.dll, 354: ImagXRA7.dll, 355: imapi.exe, 356: imapi2.dll, 357: imapi2fs.dll, 358: IMC32.acm, 359: IME, 360: imekr61.ime, 361: imeshare.dll, 362: imgutil.dll, 363: imjp81.ime, 364: imjp81k.dll, 365: imm32.dll, 366: inetcfg.dll, 367: inetcomm.dll, 368: inetcpl.cpl, 369: inetcplc.dll, 370: INETFR.DLL, 371: inetmib1.dll, 372: inetpp.dll, 373: inetppui.dll, 374: inetres.dll, 375: inetsrv, 376: infocardapi.dll, 377: infocardcpl.cpl, 378: infosoft.dll, 379: initpki.dll, 380: input.dll, 381: inseng.dll, 382: instcat.sql, 383: INT13EXT.VXD, 384: intl.cpl, 385: iologmsg.dll, 386: ipconf.tsp, 387: ipconfig.exe, 388: iphlpapi.dll, 389: ipmontr.dll, 390: ipnathlp.dll, 391: ippromon.dll, 392: iprop.dll, 393: iprtprio.dll, 394: iprtrmgr.dll, 395: ipsec6.exe, 396: ipsecsnp.dll, 397: ipsecsvc.dll, 398: ipsink.ax, 399: ipsmsnap.dll, 400: ipv6.exe, 401: ipv6mon.dll, 402: ipxmontr.dll, 403: ipxpromn.dll, 404: ipxrip.dll, 405: ipxroute.exe, 406: ipxrtmgr.dll, 407: ipxsap.dll, 408: ipxwan.dll, 409: irclass.dll, 410: irprops.cpl, 411: isign32.dll, 412: isrdbg32.dll, 413: itircl.dll, 414: itss.dll, 415: iuengine.dll, 416: ixsso.dll, 417: iyuv_32.dll, 418: java.exe, 419: javacpl.cpl, 420: javaw.exe, 421: javaws.exe, 422: jet500.dll, 423: jgaw400.dll, 424: jgdw400.dll, 425: jgmd400.dll, 426: jgpl400.dll, 427: jgsd400.dll, 428: jgsh400.dll, 429: JMRaidAPI.dll, 430: JMRaidTool.exe, 431: jobexec.dll, 432: joy.cpl, 433: jscript.dll, 434: jsfr.dll 13:39:12,5457688 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 SUCCESS 0: jsproxy.dll, 1: jupdate-1.6.0_01-b06.log, 2: jupdate-1.6.0_03-b05.log, 3: jupdate-1.6.0_05-b13.log, 4: jupdate-1.6.0_20-b02.log, 5: jupdate-1.6.0_21-b07.log, 6: jupdate-1.6.0_22-b04.log, 7: jupdate-1.6.0_23-b05.log, 8: jupdate-1.6.0_24-b07.log, 9: kanji_1.uce, 10: kanji_2.uce, 11: kb16.com, 12: kbd101.dll, 13: kbd101a.dll, 14: kbd101b.dll, 15: kbd101c.dll, 16: kbd103.dll, 17: kbd106.dll, 18: kbd106n.dll, 19: kbda1.dll, 20: kbda2.dll, 21: kbda3.dll, 22: KBDAL.DLL, 23: kbdarme.dll, 24: kbdarmw.dll, 25: kbdax2.dll, 26: kbdaze.dll, 27: kbdazel.dll, 28: kbdbe.dll, 29: kbdbene.dll, 30: kbdblr.dll, 31: kbdbr.dll, 32: kbdbu.dll, 33: kbdca.dll, 34: kbdcan.dll, 35: kbdcr.dll, 36: kbdcz.dll, 37: kbdcz1.dll, 38: kbdcz2.dll, 39: kbdda.dll, 40: kbddiv1.dll, 41: kbddiv2.dll, 42: kbddv.dll, 43: kbdes.dll, 44: kbdest.dll, 45: kbdfa.dll, 46: kbdfc.dll, 47: kbdfi.dll, 48: kbdfi1.dll, 49: kbdfo.dll, 50: kbdfr.dll, 51: kbdgae.dll, 52: kbdgeo.dll, 53: kbdgkl.dll, 54: kbdgr.dll, 55: kbdgr1.dll, 56: kbdhe.dll, 57: kbdhe220.dll, 58: kbdhe319.dll, 59: kbdheb.dll, 60: kbdhela2.dll, 61: kbdhela3.dll, 62: kbdhept.dll, 63: kbdhu.dll, 64: kbdhu1.dll, 65: kbdibm02.dll, 66: kbdic.dll, 67: kbdinbe1.dll, 68: kbdinben.dll, 69: kbdindev.dll, 70: kbdinguj.dll, 71: kbdinhin.dll, 72: kbdinkan.dll, 73: kbdinmal.dll, 74: kbdinmar.dll, 75: kbdinpun.dll, 76: kbdintam.dll, 77: kbdintel.dll, 78: kbdir.dll, 79: kbdit.dll, 80: kbdit142.dll, 81: kbdjpn.dll, 82: kbdkaz.dll, 83: kbdkor.dll, 84: kbdkyr.dll, 85: kbdla.dll, 86: kbdlk41a.dll, 87: kbdlk41j.dll, 88: kbdlt.dll, 89: kbdlt1.dll, 90: kbdlv.dll, 91: kbdlv1.dll, 92: kbdmac.dll, 93: kbdmaori.dll, 94: kbdmlt47.dll, 95: kbdmlt48.dll, 96: kbdmon.dll, 97: kbdne.dll, 98: kbdnec.dll, 99: kbdnec95.dll, 100: kbdnecAT.dll, 101: kbdnecNT.dll, 102: kbdno.dll, 103: kbdno1.dll, 104: kbdpl.dll, 105: kbdpl1.dll, 106: kbdpo.dll, 107: kbdro.dll, 108: kbdru.dll, 109: kbdru1.dll, 110: kbdsf.dll, 111: kbdsg.dll, 112: kbdsl.dll, 113: kbdsl1.dll, 114: kbdsmsfi.dll, 115: kbdsmsno.dll, 116: kbdsp.dll, 117: kbdsw.dll, 118: kbdsyr1.dll, 119: kbdsyr2.dll, 120: kbdtat.dll, 121: kbdth0.dll, 122: kbdth1.dll, 123: kbdth2.dll, 124: kbdth3.dll, 125: kbdtuf.dll, 126: kbdtuq.dll, 127: kbduk.dll, 128: kbdukx.dll, 129: kbdur.dll, 130: kbdurdu.dll, 131: kbdus.dll, 132: kbdusa.dll, 133: kbdusl.dll, 134: kbdusr.dll, 135: kbdusx.dll, 136: kbduzb.dll, 137: kbdvntc.dll, 138: kbdycc.dll, 139: kbdycl.dll, 140: kd1394.dll, 141: kdcom.dll, 142: kerberos.dll, 143: kernel32.dll, 144: key01.sys, 145: keyboard.drv, 146: keyboard.sys, 147: keymgr.dll, 148: kmddsp.tsp, 149: korean.uce, 150: korwbrkr.dll, 151: korwbrkr.lex, 152: krnl386.exe, 153: ksc.nls, 154: ksproxy.ax, 155: kstvtune.ax, 156: ksuser.dll, 157: kswdmcap.ax, 158: ksxbar.ax, 159: l3codeca.acm, 160: label.exe, 161: lame.exe, 162: lameACM.acm, 163: lame_acm.xml, 164: langwrbk.dll, 165: lanman.drv, 166: LAPRXY.dll, 167: lcphrase.tbl, 168: lcptr.tbl, 169: Leadtools.Windows.Media.Effects.dll, 170: LedCommon.dll, 171: LegitCheckControl.dll, 172: Les Simpson - Le film dir, 173: lfbmp13n.dll, 174: lfcmp13n.dll, 175: lfgif13n.dll, 176: lftga13n.dll, 177: libdivx.dll, 178: licdll.dll, 179: licmgr10.dll, 180: licwmi.dll, 181: lights.exe, 182: linkinfo.dll, 183: ljakwpjb.ini, 184: lmhsvc.dll, 185: lmpgad.ax, 186: lmrt.dll, 187: LMRTREND.dll, 188: lnkstub.exe, 189: loadfix.com, 190: loadperf.dll, 191: locale.nls, 192: localsec.dll, 193: localspl.dll, 194: localui.dll, 195: locator.exe, 196: lodctr.exe, 197: logagent.exe, 198: LogFiles, 199: loghours.dll, 200: logman.exe, 201: logoff.exe, 202: logon.scr, 203: logonui.exe, 204: lpk.dll, 205: lpq.exe, 206: lpr.exe, 207: lprhelp.dll, 208: lprmonui.dll, 209: lsasrv.dll, 210: lsass.exe, 211: ltdis13n.dll, 212: ltefx13n.dll, 213: ltfil13n.dll, 214: ltimg13n.dll, 215: ltkrn13n.dll, 216: lusrmgr.msc, 217: LWBHMVXD.VXD, 218: lz32.dll, 219: lzexpand.dll, 220: l_except.nls, 221: l_intl.nls, 222: Macromed, 223: MaDRM.dll, 224: magnify.exe, 225: mag_hook.dll, 226: main.cpl, 227: MaJGUILib.dll, 228: MaJUtilLib.dll, 229: makecab.exe, 230: MAMACExtract.dll, 231: MAPI.DLL, 232: mapi32.dll, 233: MAPISRVR.EXE, 234: MAPISTUB.DLL, 235: MaXMLProto.dll, 236: mcastmib.dll, 237: mcd32.dll, 238: mcdsrv32.dll, 239: mchgrcoi.dll, 240: MCI32.OCX, 241: mciavi.drv, 242: mciavi32.dll, 243: mcicda.dll, 244: mciole16.dll, 245: mciole32.dll, 246: mciqtz.drv, 247: mciqtz32.dll, 248: mciseq.dll, 249: mciseq.drv, 250: mciwave.dll, 251: mciwave.drv, 252: mcrh.tmp, 253: mdhcp.dll, 254: mdimon.dll, 255: mdminst.dll, 256: MDT2FW95.DLL, 257: mdwmdmsp.dll, 258: MediaImpression Slideshow, 259: MediaImpression Slideshow.scr, 260: mem.exe, 261: mf3216.dll, 262: mfc40.dll, 263: mfc40loc.dll, 264: mfc40u.dll, 265: mfc42.dll, 266: MFC42FRA.DLL, 267: mfc42loc.dll, 268: mfc42u.dll, 269: mfc70.dll, 270: mfc71.dll, 271: mfc71d.dll, 272: MFC71LU.DLL, 273: MFC71u.dll, 274: mfcsubs.dll, 275: MFPLAT.dll, 276: mgmtapi.dll, 277: mib.bin, 278: Microsoft, 279: Microsoft.VC80.ATL.manifest, 280: midimap.dll, 281: miglibnt.dll, 282: migpwd.exe, 283: milcore.dll, 284: mimefilt.dll, 285: miniime.tpl, 286: mlang.dat, 287: mlang.dll, 288: mll_hp.dll, 289: mll_mtf.dll, 290: mll_qic.dll, 291: mmc.exe, 292: mmcbase.dll, 293: mmcndmgr.dll, 294: mmcshext.dll, 295: mmdriver.inf, 296: mmdrv.dll, 297: mmfutil.dll, 298: mmsys.cpl, 299: mmsystem.dll, 300: mmtask.tsk, 301: mmutilse.dll, 302: mnmdd.dll, 303: mnmsrvc.exe, 304: mobsync.dll, 305: mobsync.exe, 306: mode.com, 307: modemui.dll, 308: modex.dll, 309: more.com, 310: moricons.dll, 311: mountvol.exe, 312: mouse.drv, 313: MouseEventsCapture.ocx, 314: MP43DECD.dll, 315: MP43DMOD.dll, 316: MP4SDECD.dll, 317: MP4SDMOD.dll, 318: MP4Splitter.ax, 319: mpeg2data.ax, 320: mpg2splt.ax, 321: mpg4c32.dll, 322: MPG4DECD.dll, 323: MPG4DMOD.dll, 324: mpg4ds32.ax, 325: mplay32.exe, 326: mpnotify.exe, 327: mpr.dll, 328: mprapi.dll, 329: mprddm.dll, 330: mprdim.dll, 331: mprmsg.dll, 332: mprui.dll, 333: mrinfo.exe, 334: MRT.exe, 335: msaatext.dll, 336: msacm.dll, 337: msacm32.dll, 338: msacm32.drv, 339: msadds32.ax, 340: msadp32.acm, 341: msafd.dll, 342: msapsspc.dll, 343: msasn1.dll, 344: msaud32.acm, 345: msaudite.dll, 346: mscat32.dll, 347: MSCC2FR.DLL, 348: mscdexnt.exe, 349: mscms.dll, 350: MSCOMCT2.OCX, 351: MSCOMCTL.OCX, 352: msconf.dll, 353: mscoree.dll, 354: mscorier.dll, 355: mscories.dll, 356: mscpx32r.dLL, 357: mscpxl32.dLL, 358: msctf.dll, 359: MSCTFIME.IME, 360: MSCTFP.dll, 361: msdadiag.dll, 362: msdart.dll, 363: msdatsrc.tlb, 364: msdayi.tbl, 365: msdmo.dll, 366: MsDtc, 367: msdtc.exe, 368: msdtclog.dll, 369: msdtcprf.h, 370: msdtcprf.ini, 371: msdtcprx.dll, 372: msdtctm.dll, 373: msdtcuiu.dll, 374: msdxm.ocx, 375: msdxmlc.dll, 376: msencode.dll, 377: msexch40.dll, 378: msexcl40.dll, 379: msfeeds.dll, 380: msfeedsbs.dll, 381: msfeedssync.exe, 382: msftedit.dll, 383: msg.exe, 384: msg711.acm, 385: msg723.acm, 386: msgina.dll, 387: msgsm32.acm, 388: msgsvc.dll, 389: msh261.drv, 390: msh263.drv, 391: mshearts.exe, 392: mshta.exe, 393: mshtml.dll, 394: mshtml.tlb, 395: mshtmled.dll, 396: mshtmler.dll, 397: msi.dll, 398: msidcrl40.dll, 399: msident.dll, 400: msidle.dll, 401: msidntld.dll, 402: msieftp.dll, 403: msiexec.exe, 404: msihnd.dll, 405: msimg32.dll, 406: msimsg.dll, 407: MSIMTF.dll, 408: MSINET.oca, 409: MSINET.OCX, 410: msir3jp.dll, 411: msir3jp.lex, 412: msisam10.dll, 413: msisip.dll, 414: msjava.dll, 415: msjet35.dll, 416: msjet40.dll, 417: msjetoledb40.dll, 418: msjint35.dll, 419: msjint40.dll, 420: msjter35.dll, 421: msjter40.dll, 422: msjtes40.dll, 423: mslbui.dll, 424: msls31.dll, 425: msltus40.dll, 426: MSLUP71.dll, 427: MSLUR71.dll, 428: msnetobj.dll, 429: msnsspc.dll, 430: msobjs.dll, 431: msoeacct.dll, 432: msoert2.dll, 433: msorc32r.dll, 434: msorcl32.dll, 435: mspaint.exe, 436: mspatcha.dll, 437: mspbde40.dll, 438: mspmsnsv.dll, 439: mspmsp.dll, 440: msports.dll 13:39:12,5460594 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 SUCCESS 0: msprivs.dll, 1: MSPRPFR.DLL, 2: msr2c.dll, 3: msr2cenu.dll, 4: msratelc.dll, 5: msrating.dll, 6: msrclr40.dll, 7: msrd2x40.dll, 8: msrd3x40.dll, 9: MSRDO20.DLL, 10: msrecr40.dll, 11: msrepl35.dll, 12: msrepl40.dll, 13: msrle32.dll, 14: MSRTEDIT.DLL, 15: mssap.dll, 16: msscds32.ax, 17: msscp.dll, 18: msscript.ocx, 19: mssign32.dll, 20: mssip32.dll, 21: MSSTDFMT.DLL, 22: MSSTKPRP.DLL, 23: msswch.dll, 24: msswchx.exe, 25: mstask.dll, 26: mstext40.dll, 27: mstime.dll, 28: mstinit.exe, 29: mstlsapi.dll, 30: mstsc.exe, 31: mstscax.dll, 32: msuni10.dll, 33: msutb.dll, 34: msv1_0.dll, 35: msvbvm50.dll, 36: msvbvm60.dll, 37: msvcirt.dll, 38: msvcp50.dll, 39: msvcp60.dll, 40: msvcp70.dll, 41: msvcp71.dll, 42: msvcr100_clr0400.dll, 43: msvcr70.dll, 44: msvcr71.dll, 45: msvcr71d.dll, 46: msvcrt.dll, 47: msvcrt20.dll, 48: msvcrt40.dll, 49: msvfw32.dll, 50: msvidc32.dll, 51: msvidctl.dll, 52: msvideo.dll, 53: msw3prt.dll, 54: mswdat10.dll, 55: mswebdvd.dll, 56: MSWINSCK.OCX, 57: mswmdm.dll, 58: mswsock.dll, 59: mswstr10.dll, 60: msxbde40.dll, 61: msxml.dll, 62: msxml2.dll, 63: msxml2r.dll, 64: msxml3.dll, 65: msxml3a.dll, 66: msxml3r.dll, 67: msxml4.dll, 68: msxml4a.dll, 69: msxml4r.dll, 70: msxml6.dll, 71: msxml6r.dll, 72: msxmlr.dll, 73: msyuv.dll, 74: mtxclu.dll, 75: mtxdm.dll, 76: mtxex.dll, 77: mtxlegih.dll, 78: mtxoci.dll, 79: mucltui.dll, 80: mucltui.dll.mui, 81: mui, 82: muweb.dll, 83: muzaf1.dll, 84: muzapp.dll, 85: muzapp.exe, 86: muzdecode.ax, 87: muzeffect.ax, 88: muzmp4sp.ax, 89: muzmpgsp.ax, 90: muzoggsp.ax, 91: muzwmts.dll, 92: mycomput.dll, 93: mydocs.dll, 94: narrator.exe, 95: narrhook.dll, 96: nbtstat.exe, 97: ncobjapi.dll, 98: ncpa.cpl, 99: ncxpnt.dll, 100: nddeapi.dll, 101: nddeapir.exe, 102: nddenb32.dll, 103: ndptsp.tsp, 104: NeroCheck.exe, 105: net.exe, 106: net.hlp, 107: net1.exe, 108: netapi.dll, 109: netapi32.dll, 110: netcfgx.dll, 111: netdde.exe, 112: netevent.dll, 113: netfxperf.dll, 114: neth.dll, 115: netid.dll, 116: netlogon.dll, 117: netman.dll, 118: netmsg.dll, 119: netplwiz.dll, 120: netrap.dll, 121: netsetup.cpl, 122: netsetup.exe, 123: netsh.exe, 124: netshell.dll, 125: netstat.exe, 126: netui0.dll, 127: netui1.dll, 128: netui2.dll, 129: newdev.dll, 130: nlhtml.dll, 131: nlsdl.dll, 132: nlsfunc.exe, 133: nmevtmsg.dll, 134: nmmkcert.dll, 135: noise.chs, 136: noise.cht, 137: noise.dat, 138: noise.deu, 139: noise.esn, 140: noise.fra, 141: noise.ita, 142: noise.jpn, 143: noise.kor, 144: noise.nld, 145: noise.sve, 146: noise.tha, 147: normaliz.dll, 148: normidna.nls, 149: normnfc.nls, 150: normnfd.nls, 151: normnfkc.nls, 152: normnfkd.nls, 153: notepad.exe, 154: npp, 155: npptools.dll, 156: nscompat.tlb, 157: nslookup.exe, 158: ntdll.dll, 159: ntdos.sys, 160: ntdos404.sys, 161: ntdos411.sys, 162: ntdos412.sys, 163: ntdos804.sys, 164: ntdsapi.dll, 165: ntimage.gif, 166: ntio.sys, 167: ntio404.sys, 168: ntio411.sys, 169: ntio412.sys, 170: ntio804.sys, 171: ntkrnlpa.exe, 172: ntlanman.dll, 173: ntlanui.dll, 174: ntlanui2.dll, 175: ntlsapi.dll, 176: ntmarta.dll, 177: ntmsapi.dll, 178: ntmsdba.dll, 179: ntmsevt.dll, 180: ntmsmgr.dll, 181: ntmsmgr.msc, 182: ntmsoprq.msc, 183: ntmssvc.dll, 184: ntoskrnl.exe, 185: ntprint.dll, 186: ntsd.exe, 187: ntsdexts.dll, 188: ntshrui.dll, 189: ntvdm.exe, 190: ntvdmd.dll, 191: nusrmgr.cpl, 192: nv4_disp.dll, 193: nvapi.dll, 194: NvApps.xml, 195: nvcod.dll, 196: nvcodins.dll, 197: nvcolor.exe, 198: nvcpl.cpl, 199: nvcpl.dll, 200: nvcplui.exe, 201: nvcpluir.dll, 202: nvcuda.dll, 203: nvcuvenc.dll, 204: nvcuvid.dll, 205: nvdata.bin, 206: nvdisp.nvu, 207: nvdisps.dll, 208: nvdispsr.dll, 209: nvexpbar.dll, 210: nvgames.dll, 211: nvgamesr.dll, 212: nvmccs.dll, 213: nvmccsrs.dll, 214: nvmccss.dll, 215: nvmccssr.dll, 216: nvmctray.dll, 217: nvmobls.dll, 218: nvmoblsr.dll, 219: nvModes.dat, 220: nvnt4cpl.dll, 221: nvoglnt.dll, 222: nvrsar.dll, 223: nvrscs.dll, 224: nvrsda.dll, 225: nvrsde.dll, 226: nvrsel.dll, 227: nvrseng.dll, 228: nvrses.dll, 229: nvrsesm.dll, 230: nvrsfi.dll, 231: nvrsfr.dll, 232: nvrshe.dll, 233: nvrshu.dll, 234: nvrsit.dll, 235: nvrsja.dll, 236: nvrsko.dll, 237: nvrsnl.dll, 238: nvrsno.dll, 239: nvrspl.dll, 240: nvrspt.dll, 241: nvrsptb.dll, 242: nvrsru.dll, 243: nvrssk.dll, 244: nvrssl.dll, 245: nvrssv.dll, 246: nvrsth.dll, 247: nvrstr.dll, 248: nvrszhc.dll, 249: nvrszht.dll, 250: nvsvc32.exe, 251: nvucode.bin, 252: nvudisp.exe, 253: NVUNINST.EXE, 254: nvvitvs.dll, 255: nvvitvsr.dll, 256: nvwddi.dll, 257: NvwsApps.xml, 258: nvwss.dll, 259: nvwssr.dll, 260: nwprovau.dll, 261: oakley.dll, 262: objsel.dll, 263: occache.dll, 264: ocmanage.dll, 265: odbc16gt.dll, 266: odbc32.dll, 267: odbc32gt.dll, 268: odbcad32.exe, 269: odbcbcp.dll, 270: odbcconf.dll, 271: odbcconf.exe, 272: odbcconf.rsp, 273: odbccp32.cpl, 274: odbccp32.dll, 275: odbccr32.dll, 276: odbccu32.dll, 277: odbcint.dll, 278: odbcji32.dll, 279: odbcjt32.dll, 280: odbcp32r.dll, 281: odbctrac.dll, 282: oddbse32.dll, 283: odexl32.dll, 284: odfox32.dll, 285: odpdx32.dll, 286: odtext32.dll, 287: oembios.bin, 288: oembios.dat, 289: oembios.sig, 290: offfilt.dll, 291: ole2.dll, 292: ole2disp.dll, 293: ole2nls.dll, 294: ole32.dll, 295: oleacc.dll, 296: oleaccrc.dll, 297: oleaut32.dll, 298: olecli.dll, 299: olecli32.dll, 300: olecnv32.dll, 301: oledlg.dll, 302: oleprn.dll, 303: olepro32.dll, 304: olesvr.dll, 305: olesvr32.dll, 306: olethk32.dll, 307: oobe, 308: OpenAL32.dll, 309: opengl32.dll, 310: OpenQuicktimeLib.dll, 311: osk.exe, 312: osuninst.dll, 313: osuninst.exe, 314: OUTLPERF.H, 315: OUTLPERF.INI, 316: ov530ext.ax, 317: ov530ext.dll, 318: ov530usd.dll, 319: OVCodec2.dll, 320: OVComC.dll, 321: OVComS.exe, 322: OVUI2.dll, 323: OVUI2RC.dll, 324: p2p.dll, 325: p2pgasvc.dll, 326: p2pgraph.dll, 327: p2pnetsh.dll, 328: p2psvc.dll, 329: packager.exe, 330: panmap.dll, 331: paqsp.dll, 332: pathping.exe, 333: pautoenr.dll, 334: pbsvc.exe, 335: PCCLPFR.DLL, 336: pcl.sep, 337: pdh.dll, 338: pentnt.exe, 339: perfc009.dat, 340: perfc00C.dat, 341: perfci.h, 342: perfci.ini, 343: perfctrs.dll, 344: perfd009.dat, 345: perfd00C.dat, 346: perfdisk.dll, 347: perffilt.h, 348: perffilt.ini, 349: perfh009.dat, 350: perfh00C.dat, 351: perfi009.dat, 352: perfi00C.dat, 353: perfmon.exe, 354: perfmon.msc, 355: perfnet.dll, 356: perfos.dll, 357: perfproc.dll, 358: PerfStringBackup.INI, 359: perfts.dll, 360: perfwci.h, 361: perfwci.ini, 362: phon.ime, 363: phon.tbl, 364: phoncode.tbl, 365: phonptr.tbl, 366: photometadatahandler.dll, 367: photowiz.dll, 368: PhysX.cpl, 369: PhysXCompatCplUI.exe, 370: PhysXCplUI.exe, 371: physxcudart_20.dll, 372: PhysXDevice.dll, 373: PhysXLoader.dll, 374: PICCLP32.OCX, 375: PICEntry.dll, 376: picn20.dll, 377: PICSDK.dll, 378: PICSDK.ini, 379: PICSDK2.dll, 380: pid.dll, 381: pidgen.dll, 382: pifmgr.dll, 383: ping.exe, 384: ping6.exe, 385: PINTLGNT.IME, 386: PINTLPAD.HLP, 387: PINTLPAE.HLP, 388: pintool.exe, 389: pjlmon.dll, 390: plustab.dll, 391: pmspl.dll, 392: pncrt.dll, 393: pngfilt.dll, 394: PnkBstrA.exe, 395: PnkBstrB.exe, 396: pnrpnsp.dll, 397: polstore.dll, 398: popup.ocx, 399: PortableDeviceApi.dll, 400: PortableDeviceClassExtension.dll, 401: PortableDeviceTypes.dll, 402: PortableDeviceWiaCompat.dll, 403: PortableDeviceWMDRM.dll, 404: PostProc.dll, 405: powercfg.cpl, 406: powercfg.exe, 407: powrprof.dll, 408: PPLive, 409: prc.nls, 410: prcp.nls, 411: PreInstall, 412: PresentationCFFRasterizerNative_v0300.dll, 413: PresentationHost.exe, 414: PresentationHostProxy.dll, 415: PresentationNative_v0300.dll, 416: prflbmsg.dll, 417: print.exe, 418: printui.dll, 419: prncnfgd, 420: prntvpt.dll, 421: proctexe.ocx, 422: prodspec.ini, 423: profmap.dll, 424: progman.exe, 425: proquota.exe, 426: proxycfg.exe, 427: psapi.dll, 428: psbase.dll, 429: pschdcnt.h, 430: pschdprf.dll, 431: pschdprf.ini 13:39:12,5463992 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 SUCCESS 0: pscript.sep, 1: psnppagn.dll, 2: pstorec.dll, 3: pstorsvc.dll, 4: ptevideo.dll, 5: pthreadGC2.dll, 6: ptpusb.dll, 7: ptpusd.dll, 8: pubprn.vbs, 9: px.dll, 10: pxafs.dll, 11: pxcpya64.exe, 12: pxcpyi64.exe, 13: pxdrv.dll, 14: pxhpinst.exe, 15: pxinsa64.exe, 16: pxinsi64.exe, 17: pxmas.dll, 18: pxsfs.dll, 19: pxwave.dll, 20: qappsrv.exe, 21: qasf.dll, 22: qcap.dll, 23: qcut.dll, 24: qdv.dll, 25: qdvd.dll, 26: qedit.dll, 27: qedwipes.dll, 28: qmgr.dll, 29: qmgrprxy.dll, 30: qosname.dll, 31: qprocess.exe, 32: qt-dx331.dll, 33: quartz.dll, 34: quartz.vxd, 35: query.dll, 36: quick.ime, 37: QuickTime.qts, 38: QuickTimeVR.qtx, 39: qwinsta.exe, 40: racpldlg.dll, 41: ras, 42: rasadhlp.dll, 43: rasapi32.dll, 44: rasauto.dll, 45: rasautou.exe, 46: raschap.dll, 47: rasctrnm.h, 48: rasctrs.dll, 49: rasctrs.ini, 50: rasdial.exe, 51: rasdlg.dll, 52: rasman.dll, 53: rasmans.dll, 54: rasmontr.dll, 55: rasmxs.dll, 56: rasphone.exe, 57: rasppp.dll, 58: rasrad.dll, 59: rassapi.dll, 60: rasser.dll, 61: rastapi.dll, 62: rastls.dll, 63: rcbdyctl.dll, 64: RCHTXFR.DLL, 65: rcimlby.exe, 66: rcp.exe, 67: rdchost.dll, 68: RDOCURS.DLL, 69: rdpcfgex.dll, 70: rdpclip.exe, 71: rdpdd.dll, 72: rdpsnd.dll, 73: rdpwsx.dll, 74: rdsaddin.exe, 75: rdshost.exe, 76: readme.txt, 77: RealMediaSplitter.ax, 78: recover.exe, 79: redir.exe, 80: reg.exe, 81: regapi.dll, 82: regedt32.exe, 83: regini.exe, 84: regsvc.dll, 85: regsvr32.exe, 86: regwiz.exe, 87: regwizc.dll, 88: ReinstallBackups, 89: remotepg.dll, 90: remotesp.tsp, 91: rend.dll, 92: replace.exe, 93: reset.exe, 94: Restore, 95: results.txt, 96: resutils.dll, 97: rexec.exe, 98: rgb9rast_2.dll, 99: rgc4.dll, 100: rhttpaa.dll, 101: riched20.dll, 102: riched32.dll, 103: RICHTX32.OCX, 104: rmoc3260.dll, 105: rnafwfmb.ini, 106: rnr20.dll, 107: romanime.ime, 108: route.exe, 109: routemon.exe, 110: routetab.dll, 111: rpcns4.dll, 112: rpcrt4.dll, 113: rpcss.dll, 114: rsaci.rat, 115: rsaenh.dll, 116: rsh.exe, 117: rshx32.dll, 118: rsm.exe, 119: rsmps.dll, 120: rsmsink.exe, 121: rsmui.exe, 122: rsvp.exe, 123: rsvp.ini, 124: rsvpcnts.h, 125: rsvpmsg.dll, 126: rsvpperf.dll, 127: rsvpsp.dll, 128: rtcshare.exe, 129: rtipxmib.dll, 130: rtm.dll, 131: rtutils.dll, 132: runas.exe, 133: rundll32.exe, 134: runonce.exe, 135: rwinsta.exe, 136: safrcdlg.dll, 137: safrdm.dll, 138: safrslv.dll, 139: samlib.dll, 140: samsrv.dll, 141: Samsung_USB_Drivers, 142: satsukidecodersettings.ini, 143: sav80231.sys, 144: savedump.exe, 145: sbe.dll, 146: sbeio.dll, 147: sc.exe, 148: scarddlg.dll, 149: scardssp.dll, 150: scardsvr.exe, 151: sccbase.dll, 152: sccsccp.dll, 153: scecli.dll, 154: scesrv.dll, 155: schannel.dll, 156: schedsvc.dll, 157: sclgntfy.dll, 158: scofr.dll, 159: SCP32.DLL, 160: scredir.dll, 161: scrnsave.scr, 162: scrobj.dll, 163: scrrnfr.dll, 164: scrrun.dll, 165: sdbinst.exe, 166: sdhcinst.dll, 167: sdpblb.dll, 168: seclogon.dll, 169: secupd.dat, 170: secupd.sig, 171: secur32.dll, 172: security.dll, 173: sendcmsg.dll, 174: sendmail.dll, 175: sens.dll, 176: sensapi.dll, 177: senscfg.dll, 178: serialui.dll, 179: servdeps.dll, 180: services.exe, 181: services.msc, 182: serwvdrv.dll, 183: sessmgr.exe, 184: SET62.tmp, 185: SET64.tmp, 186: SET69.tmp, 187: SET74.tmp, 188: setb0.tmp, 189: sethc.exe, 190: Setup, 191: setup.bmp, 192: setup.exe, 193: setupapi.dll, 194: setupdll.dll, 195: setver.exe, 196: sfc.dll, 197: sfc.exe, 198: sfcfiles.dll, 199: sfc_os.dll, 200: sfmapi.dll, 201: shadow.exe, 202: share.exe, 203: shdoclc.dll, 204: shdocvw.dll, 205: shell.dll, 206: shell32.dll, 207: ShellExt, 208: shellstyle.dll, 209: shfolder.dll, 210: shgina.dll, 211: shiftjis.uce, 212: shimeng.dll, 213: shimgvw.dll, 214: shlwapi.dll, 215: shmedia.dll, 216: shmgrate.exe, 217: shrpubw.exe, 218: shscrap.dll, 219: shsvcs.dll, 220: shutdown.exe, 221: SHW32.DLL, 222: sigtab.dll, 223: sigverif.exe, 224: simpdata.tlb, 225: sirenacm.dll, 226: sisbkup.dll, 227: skdll.dll, 228: skeys.exe, 229: skinboxer43.dll, 230: slayerxp.dll, 231: slbcsp.dll, 232: slbiop.dll, 233: slbrccsp.dll, 234: sl_anet.acm, 235: smbinst.exe, 236: smlogcfg.dll, 237: smlogsvc.exe, 238: SMMedia.dll, 239: smss.exe, 240: sndrec32.exe, 241: sndvol32.exe, 242: snmpapi.dll, 243: snmpsnap.dll, 244: softpub.dll, 245: SoftwareDistribution, 246: sol.exe, 247: sort.exe, 248: sortkey.nls, 249: sorttbls.nls, 250: sound.drv, 251: spider.exe, 252: spmsg.dll, 253: spmsg2.dll, 254: spnike.dll, 255: spnpinst.exe, 256: spool, 257: spoolss.dll, 258: spoolsv.exe, 259: SpoonUninstall-dBpowerAMP FLAC Codec.bmp, 260: SpoonUninstall-dBpowerAMP FLAC Codec.dat, 261: SpoonUninstall-dBpoweramp Music Converter.bmp, 262: SpoonUninstall-dBpoweramp Music Converter.dat, 263: SpoonUninstall.exe, 264: SpOrder.dll, 265: sprestrt.exe, 266: sprio600.dll, 267: sprio800.dll, 268: spupdsvc.exe, 269: spxcoins.dll, 270: sqlsodbc.chm, 271: sqlsrv32.dll, 272: sqlsrv32.rll, 273: sqlunirl.dll, 274: sqlwid.dll, 275: sqlwoa.dll, 276: srclient.dll, 277: srrstr.dll, 278: srsvc.dll, 279: srvsvc.dll, 280: ss3dfo.scr, 281: ssbezier.scr, 282: ssdpapi.dll, 283: ssdpsrv.dll, 284: ssflwbox.scr, 285: ssldivx.dll, 286: ssmarque.scr, 287: ssmypics.scr, 288: ssmyst.scr, 289: sspipes.scr, 290: ssstars.scr, 291: sstext3d.scr, 292: stclient.dll, 293: STDFTFR.DLL, 294: stdole2.tlb, 295: stdole32.tlb, 296: sti.dll, 297: stimon.exe, 298: sti_ci.dll, 299: stobject.dll, 300: storage.dll, 301: storprop.dll, 302: streamci.dll, 303: strmdll.dll, 304: strmfilt.dll, 305: subrange.uce, 306: subst.exe, 307: svchost.exe, 308: svcpack.dll, 309: swprv.dll, 310: sxs.dll, 311: syncapp.exe, 312: synceng.dll, 313: syncui.dll, 314: sysdm.cpl, 315: sysedit.exe, 316: sysinv.dll, 317: syskey.exe, 318: sysmon.ocx, 319: SYSMOUSE.VXD, 320: sysocmgr.exe, 321: sysprint.sep, 322: sysprtj.sep, 323: syssetup.dll, 324: system.drv, 325: systray.exe, 326: t.txt, 327: t2embed.dll, 328: TABCTFR.DLL, 329: tapi.dll, 330: tapi3.dll, 331: tapi32.dll, 332: tapiperf.dll, 333: tapisrv.dll, 334: tapiui.dll, 335: taskmgr.exe, 336: tcmsetup.exe, 337: tcpmib.dll, 338: tcpmon.dll, 339: tcpmon.ini, 340: tcpmonui.dll, 341: tcpsvcs.exe, 342: tdc.ocx, 343: telephon.cpl, 344: telnet.exe, 345: termmgr.dll, 346: termsrv.dll, 347: tftp.exe, 348: tg_dump.dll, 349: TG_DUMP0708.DLL, 350: Thawbrkr.dll, 351: themeui.dll, 352: ticrf.rat, 353: timedate.cpl, 354: timer.drv, 355: TINTLGNT.IME, 356: tm20dec.ax, 357: tmp8AB76.FOT, 358: tmpABC4C.FOT, 359: toolhelp.dll, 360: tourstart.exe, 361: tracert.exe, 362: tracert6.exe, 363: traffic.dll, 364: tree.com, 365: trkwks.dll, 366: tsappcmp.dll, 367: tsbyuv.dll, 368: tscfgwmi.dll, 369: tscon.exe, 370: tscupgrd.exe, 371: tsd32.dll, 372: tsddd.dll, 373: tsdiscon.exe, 374: tsgqec.dll, 375: tskill.exe, 376: tslabels.h, 377: tslabels.ini, 378: tsshutdn.exe, 379: tssoft32.acm, 380: tswpfwrp.exe, 381: twext.dll, 382: TwnLib20.dll, 383: TwnLib4.dll, 384: txflog.dll, 385: typelib.dll, 386: tzchange.exe, 387: TZLog.log, 388: udhisapi.dll, 389: ufat.dll, 390: UIAutomationCore.dll, 391: ulib.dll, 392: umandlg.dll, 393: umdmxfrm.dll, 394: umpnpmgr.dll, 395: unam4ie.exe, 396: unicdime.ime, 397: unicode.nls, 398: unicows.dll, 399: uniime.dll, 400: unimdm.tsp, 401: unimdmat.dll, 402: Uninstall.ico, 403: uniplat.dll, 404: unlodctr.exe, 405: unrar.dll, 406: untfs.dll, 407: upnp.dll, 408: upnpcont.exe, 409: upnphost.dll, 410: upnpui.dll, 411: ups.exe, 412: ureg.dll, 413: url.dll, 414: urlmon.dll, 415: URTTemp, 416: usbmon.dll, 417: usbui.dll, 418: user.exe, 419: user32.dll, 420: userenv.dll, 421: userinit.exe, 422: usmt, 423: usp10.dll, 424: usrcntra.dll, 425: usrcoina.dll, 426: usrdpa.dll, 427: usrdtea.dll, 428: usrfaxa.dll, 429: usrlbva.dll, 430: usrlogon.cmd, 431: usrmlnka.exe, 432: usrprbda.exe, 433: usrrtosa.dll, 434: usrsdpia.dll, 435: usrshuta.exe, 436: usrsvpia.dll 13:39:12,5466211 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 SUCCESS 0: usrv42a.dll, 1: usrv80a.dll, 2: usrvoica.dll, 3: usrvpa.dll, 4: utildll.dll, 5: utilman.exe, 6: uwdf.exe, 7: uxtheme.bak, 8: uxtheme.dll, 9: v7vga.rom, 10: VB5DB.DLL, 11: vb5fr.dll, 12: VB6FR.DLL, 13: VB6STKIT.DLL, 14: VBAEN32.OLB, 15: VBAEND32.OLB, 16: VBAFR32.OLB, 17: vbajet32.dll, 18: vbalFlBr6.dll, 19: VBAME.DLL, 20: vbisurf.ax, 21: vbscript.dll, 22: vbsfr.dll, 23: vcdex.dll, 24: vdmdbg.dll, 25: vdmredir.dll, 26: VEN2232.OLB, 27: ver.dll, 28: verclsid.exe, 29: verifier.dll, 30: verifier.exe, 31: version.dll, 32: vfpodbc.dll, 33: vfwwdm32.dll, 34: vga.dll, 35: vga.drv, 36: vga256.dll, 37: vga64k.dll, 38: vidcap.ax, 39: vidx16.dll, 40: vihmkqyt.ini, 41: vjoy.dll, 42: vorbis.acm, 43: voxmsdec.ax, 44: VSFLEX3.OCX, 45: vssadmin.exe, 46: vssapi.dll, 47: vssvc.exe, 48: vss_ps.dll, 49: vxblock.dll, 50: w32time.dll, 51: w32tm.exe, 52: w32topl.dll, 53: w3ssl.dll, 54: w95inf16.dll, 55: w95inf32.dll, 56: watchdog.sys, 57: wavemsp.dll, 58: wbcache.deu, 59: wbcache.enu, 60: wbcache.esn, 61: wbcache.fra, 62: wbcache.ita, 63: wbcache.nld, 64: wbcache.sve, 65: wbdbase.deu, 66: wbdbase.enu, 67: wbdbase.esn, 68: wbdbase.fra, 69: wbdbase.ita, 70: wbdbase.nld, 71: wbdbase.sve, 72: wbem, 73: wbsys.dll, 74: wdfapi.dll, 75: wdfmgr.exe, 76: wdigest.dll, 77: wdl.trm, 78: wdmaud.drv, 79: wdmioctl.dll, 80: webcheck.dll, 81: webclnt.dll, 82: webfldrs.msi, 83: webhits.dll, 84: webvw.dll, 85: wextract.exe, 86: wfwnet.drv, 87: WgaLogon.dll, 88: WgaTray.exe, 89: wiaacmgr.exe, 90: wiadefui.dll, 91: wiadss.dll, 92: wiascr.dll, 93: wiaservc.dll, 94: wiasf.ax, 95: wiashext.dll, 96: wiavideo.dll, 97: wiavusd.dll, 98: wifeman.dll, 99: win.com, 100: win32k.sys, 101: win32spl.dll, 102: win87em.dll, 103: winar30.ime, 104: winbrand.dll, 105: winchat.exe, 106: WindowsCodecs.dll, 107: WindowsCodecsExt.dll, 108: winfax.dll, 109: WinFXDocObj.exe, 110: WINGB.IME, 111: winhelp.hlp, 112: winhlp32.exe, 113: winhttp.dll, 114: winime.ime, 115: wininet.dll, 116: winipsec.dll, 117: winlogon.exe, 118: winmine.exe, 119: winmm.dll, 120: winmsd.exe, 121: winnls.dll, 122: WINNTBBU.DLL, 123: winoldap.mod, 124: WINPY.IME, 125: WINPY.MB, 126: winrnr.dll, 127: wins, 128: winscard.dll, 129: winshfhc.dll, 130: WINSKFR.DLL, 131: winsock.dll, 132: WINSP.IME, 133: WINSP.MB, 134: winspool.drv, 135: winspool.exe, 136: winsrv.dll, 137: winsta.dll, 138: winstrm.dll, 139: wintrust.dll, 140: winver.exe, 141: WINZM.IME, 142: WINZM.MB, 143: wkssvc.dll, 144: wldap32.dll, 145: wlnotify.dll, 146: wmadmod.dll, 147: WMADMOE.dll, 148: wmasf.dll, 149: wmdmlog.dll, 150: wmdmps.dll, 151: wmdrmdev.dll, 152: wmdrmnet.dll, 153: wmdrmsdk.dll, 154: wmerrFRA.dll, 155: wmerror.dll, 156: wmi.dll, 157: wmidx.dll, 158: wmimgmt.msc, 159: wmiprop.dll, 160: wmnetmgr.dll, 161: wmp.dll, 162: wmp.ocx, 163: wmpasf.dll, 164: wmpcd.dll, 165: wmpcore.dll, 166: wmpdxm.dll, 167: wmpeffects.dll, 168: wmpencen.dll, 169: WMPhoto.dll, 170: wmploc.dll, 171: wmpmde.dll, 172: wmpns.dll, 173: wmpps.dll, 174: wmpshell.dll, 175: wmpsrcwp.dll, 176: wmpui.dll, 177: wmsdmod.dll, 178: wmsdmoe.dll, 179: wmsdmoe2.dll, 180: WMSPDMOD.dll, 181: WMSPDMOE.dll, 182: wmstream.dll, 183: WMV8DMOD.DLL, 184: wmv8ds32.ax, 185: wmv9dmod.dll, 186: WMVADVD.dll, 187: WMVADVE.DLL, 188: wmvcore.dll, 189: WMVDECOD.dll, 190: wmvdmod.dll, 191: wmvdmoe2.dll, 192: wmvds32.ax, 193: WMVENCOD.dll, 194: WMVSDECD.dll, 195: WMVSENCD.dll, 196: WMVXENCD.dll, 197: wodfamop.dll, 198: wow32.dll, 199: wowdeb.exe, 200: wowexec.exe, 201: wowfax.dll, 202: wowfaxui.dll, 203: wpa.dbl, 204: wpabaln.exe, 205: wpdconns.dll, 206: wpdmtp.dll, 207: wpdmtpdr.dll, 208: wpdmtpus.dll, 209: WpdShext.dll, 210: wpdshextautoplay.exe, 211: wpdshextres.dll, 212: WPDShServiceObj.dll, 213: wpdsp.dll, 214: wpd_ci.dll, 215: wpnpinst.exe, 216: wrap_oal.dll, 217: write.exe, 218: ws2help.dll, 219: ws2_32.dll, 220: wscntfy.exe, 221: wscript.exe, 222: wscsvc.dll, 223: wscui.cpl, 224: wshatm.dll, 225: wshbth.dll, 226: wshcon.dll, 227: wshext.dll, 228: wshfr.dll, 229: wship6.dll, 230: wshisn.dll, 231: wshnetbs.dll, 232: wshom.ocx, 233: WshRm.dll, 234: wshtcpip.dll, 235: wsnmp32.dll, 236: wsock32.dll, 237: wstdecod.dll, 238: wtsapi32.dll, 239: wuapi.dll, 240: wuapi.dll.mui, 241: wuauclt.exe, 242: wuauclt1.exe, 243: wuaucpl.cpl, 244: wuaucpl.cpl.mui, 245: wuaueng.dll, 246: wuaueng.dll.mui, 247: wuaueng1.dll, 248: wuauserv.dll, 249: wucltui.dll, 250: wucltui.dll.mui, 251: WUDFCoinstaller.dll, 252: WudfHost.exe, 253: WudfPlatform.dll, 254: WudfSvc.dll, 255: WUDFx.dll, 256: wupdmgr.exe, 257: wups.dll, 258: wups2.dll, 259: wuweb.dll, 260: wzcdlg.dll, 261: wzcsapi.dll, 262: wzcsvc.dll, 263: x3daudio1_0.dll, 264: x3daudio1_1.dll, 265: X3DAudio1_2.dll, 266: X3DAudio1_3.dll, 267: X3DAudio1_4.dll, 268: X3DAudio1_5.dll, 269: X3DAudio1_6.dll, 270: X3DAudio1_7.dll, 271: xactengine2_0.dll, 272: xactengine2_1.dll, 273: xactengine2_10.dll, 274: xactengine2_2.dll, 275: xactengine2_3.dll, 276: xactengine2_4.dll, 277: xactengine2_5.dll, 278: xactengine2_6.dll, 279: xactengine2_7.dll, 280: xactengine2_8.dll, 281: xactengine2_9.dll, 282: xactengine3_0.dll, 283: xactengine3_1.dll, 284: xactengine3_2.dll, 285: xactengine3_3.dll, 286: xactengine3_4.dll, 287: xactengine3_5.dll, 288: xactengine3_6.dll, 289: xactengine3_7.dll, 290: xactsrv.dll, 291: XAPOFX1_0.dll, 292: XAPOFX1_1.dll, 293: XAPOFX1_2.dll, 294: XAPOFX1_3.dll, 295: XAPOFX1_4.dll, 296: XAPOFX1_5.dll, 297: XAudio2_0.dll, 298: XAudio2_1.dll, 299: XAudio2_2.dll, 300: XAudio2_3.dll, 301: XAudio2_4.dll, 302: XAudio2_5.dll, 303: XAudio2_6.dll, 304: XAudio2_7.dll, 305: xcopy.exe, 306: xenroll.dll, 307: xinput1_1.dll, 308: xinput1_2.dll, 309: xinput1_3.dll, 310: xinput9_1_0.dll, 311: xIQtAJlm.ini, 312: xIQtAJlm.ini2, 313: xircom, 314: xjis.nls, 315: xlive, 316: xlive.dll, 317: xlive.dll.cat, 318: xlivefnt.dll, 319: xmlinst.exe, 320: xmllite.dll, 321: xmlparse.dll, 322: xmlprov.dll, 323: xmlprovi.dll, 324: xmltok.dll, 325: XMNT2002.exe, 326: xolehlp.dll, 327: xpob2res.dll, 328: xpsp1res.dll, 329: xpsp2res.dll, 330: xpsp3res.dll, 331: xpsshhdr.dll, 332: xpssvcs.dll, 333: XPSViewer, 334: xvidcore.dll, 335: xvidvfw.dll, 336: yv12vfw.dll, 337: zipfldr.dll, 338: zllictbl.dat 13:39:12,5468223 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 NO MORE FILES 13:39:12,5468951 SexyCity.exe 564 CloseFile C:\WINDOWS\system32 SUCCESS 13:39:12,5470287 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5471053 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS SUCCESS 0: ., 1: .., 2: InstallTemp, 3: Manifests, 4: MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0(2).0_x-ww_6e57c34e, 5: MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e, 6: MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0(2).0_x-ww_97359ba5, 7: MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5, 8: Policies, 9: x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a, 10: x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a, 11: x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries.Resources_6595b64144ccf1df_6.0.0.0_fr-FR_9d8c4a39, 12: x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7, 13: x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a, 14: x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd, 15: x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841, 16: x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474, 17: x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1801_x-ww_5eed8217, 18: x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca, 19: x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989, 20: x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd, 21: x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700, 22: x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c, 23: x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303, 24: x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e, 25: x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05, 26: x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723, 27: x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a, 28: x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_312cf0e9, 29: x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2, 30: x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4137_x-ww_35349982, 31: x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2, 32: x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375, 33: x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e, 34: x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4137_x-ww_d494ac0e, 35: x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e, 36: x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_597c3456, 37: x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03, 38: x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313, 39: x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_a173767a, 40: x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943, 41: x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4137_x-ww_a57b1f13, 42: x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53, 43: x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1, 44: x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa, 45: x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a, 46: x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9, 47: x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03, 48: x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a, 49: x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9, 50: x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13, 51: x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82, 52: x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88, 53: x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7, 54: x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95, 55: x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_fr_457ebf3d, 56: x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0(2).0_x-ww_7d5f3790, 57: x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790, 58: x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0(2).0_x-ww_29b51492, 59: x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 13:39:12,5472627 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS NO MORE FILES 13:39:12,5473374 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS SUCCESS 13:39:12,5474531 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4053_X-WW_E6967989 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5475354 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS 0: ., 1: .., 2: msvcm80.dll, 3: msvcp80.dll, 4: msvcr80.dll 13:39:12,5476334 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 NO MORE FILES 13:39:12,5477052 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS 13:39:12,5478161 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5479273 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03 SUCCESS 0: ., 1: .., 2: comctl32.dll 13:39:12,5481396 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03 NO MORE FILES 13:39:12,5482127 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03 SUCCESS 13:39:12,5483261 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.0.2600.3352_X-WW_81AF8E88 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5484086 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88 SUCCESS 0: ., 1: .., 2: GdiPlus.dll 13:39:12,5484992 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88 NO MORE FILES 13:39:12,5486069 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88 SUCCESS 13:39:12,5486350 SexyCity.exe 564 FileSystemControl E: SUCCESS Control: FSCTL_FILE_PREFETCH 13:39:12,5488028 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ntdll.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5489065 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\ntdll.dll SUCCESS AllocationSize: 733 184, EndOfFile: 733 184, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5490136 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\ntdll.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5491192 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ntdll.dll SUCCESS 13:39:12,5492528 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ntdll.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5493589 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ntdll.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5493669 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\ntdll.dll SUCCESS AllocationSize: 733 184, EndOfFile: 733 184, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5493790 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ntdll.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5495362 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\mscoree.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5496384 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\mscoree.dll SUCCESS AllocationSize: 299 008, EndOfFile: 297 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5497344 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\mscoree.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5498382 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\mscoree.dll SUCCESS 13:39:12,5499792 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\mscoree.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5500810 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\mscoree.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5500882 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\mscoree.dll SUCCESS AllocationSize: 299 008, EndOfFile: 297 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5501001 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\mscoree.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5502619 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\kernel32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5503641 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\kernel32.dll SUCCESS AllocationSize: 1 052 672, EndOfFile: 1 049 600, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5504679 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\kernel32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5506079 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\kernel32.dll SUCCESS 13:39:12,5507444 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\kernel32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5508474 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\kernel32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5508542 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\kernel32.dll SUCCESS AllocationSize: 1 052 672, EndOfFile: 1 049 600, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5508735 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\kernel32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5510293 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\unicode.nls SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5511315 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\unicode.nls SUCCESS AllocationSize: 90 112, EndOfFile: 89 588, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5512282 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\unicode.nls SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5513303 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\unicode.nls SUCCESS 13:39:12,5514636 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\unicode.nls SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5515662 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\unicode.nls SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5515730 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\unicode.nls SUCCESS AllocationSize: 90 112, EndOfFile: 89 588, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5515844 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\unicode.nls SUCCESS SyncType: SyncTypeOther 13:39:12,5517375 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\locale.nls SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5518396 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\locale.nls SUCCESS AllocationSize: 249 856, EndOfFile: 249 270, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5519426 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\locale.nls SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5520441 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\locale.nls SUCCESS 13:39:12,5521782 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\locale.nls SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5522803 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\locale.nls SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5522871 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\locale.nls SUCCESS AllocationSize: 249 856, EndOfFile: 249 270, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5522987 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\locale.nls SUCCESS SyncType: SyncTypeOther 13:39:12,5524548 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\sorttbls.nls SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5525609 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\sorttbls.nls SUCCESS AllocationSize: 24 576, EndOfFile: 22 040, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5526582 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\sorttbls.nls SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5527613 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\sorttbls.nls SUCCESS 13:39:12,5529051 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\sorttbls.nls SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5530084 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\sorttbls.nls SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5530154 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\sorttbls.nls SUCCESS AllocationSize: 24 576, EndOfFile: 22 040, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5530269 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\sorttbls.nls SUCCESS SyncType: SyncTypeOther 13:39:12,5531830 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ctype.nls SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5532850 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\ctype.nls SUCCESS AllocationSize: 12 288, EndOfFile: 8 386, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5533813 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\ctype.nls SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5534861 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ctype.nls SUCCESS 13:39:12,5536198 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ctype.nls SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5537221 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ctype.nls SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5537287 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\ctype.nls SUCCESS AllocationSize: 12 288, EndOfFile: 8 386, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5537471 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ctype.nls SUCCESS SyncType: SyncTypeOther 13:39:12,5538490 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5539024 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5539091 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS AllocationSize: 2 101 248, EndOfFile: 2 097 664, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5539207 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeOther 13:39:12,5540737 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shimeng.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5541759 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\shimeng.dll SUCCESS AllocationSize: 65 536, EndOfFile: 65 536, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5542722 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\shimeng.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5543751 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shimeng.dll SUCCESS 13:39:12,5545081 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shimeng.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5546101 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shimeng.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5546167 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\shimeng.dll SUCCESS AllocationSize: 65 536, EndOfFile: 65 536, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5546282 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shimeng.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5547902 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5548947 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5549891 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5550887 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 27/09/2010 09:40:22, LastWriteTime: 04/10/2006 15:06:21, ChangeTime: 25/03/2008 12:05:00, FileAttributes: A 13:39:12,5551892 SexyCity.exe 564 ReadFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Offset: 0, Length: 1 024 13:39:12,5552979 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:12,5554289 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5555285 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5555353 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5555471 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeOther 13:39:12,5556984 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5558078 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5559011 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5560012 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:12,5561311 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5562306 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5562372 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5562493 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5565371 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\user32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5566425 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\user32.dll SUCCESS AllocationSize: 581 632, EndOfFile: 578 560, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5567395 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\user32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5568441 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\user32.dll SUCCESS 13:39:12,5569793 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\user32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5570826 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\user32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5570982 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\user32.dll SUCCESS AllocationSize: 581 632, EndOfFile: 578 560, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5571100 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\user32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5572647 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\gdi32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5573660 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\gdi32.dll SUCCESS AllocationSize: 282 624, EndOfFile: 282 624, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5574622 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\gdi32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5575660 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\gdi32.dll SUCCESS 13:39:12,5576983 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\gdi32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5578008 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\gdi32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5578077 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\gdi32.dll SUCCESS AllocationSize: 282 624, EndOfFile: 282 624, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5578191 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\gdi32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5579735 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\advapi32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5580754 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\advapi32.dll SUCCESS AllocationSize: 688 128, EndOfFile: 685 056, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5581713 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\advapi32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5582729 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\advapi32.dll SUCCESS 13:39:12,5584054 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\advapi32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5585078 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\advapi32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5585146 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\advapi32.dll SUCCESS AllocationSize: 688 128, EndOfFile: 685 056, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5585263 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\advapi32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5587378 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5588472 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS AllocationSize: 585 728, EndOfFile: 582 656, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5589436 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\rpcrt4.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5590467 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS 13:39:12,5591803 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5592828 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\rpcrt4.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5592897 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS AllocationSize: 585 728, EndOfFile: 582 656, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5593016 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\rpcrt4.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5594558 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\winmm.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5595949 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\winmm.dll SUCCESS AllocationSize: 184 320, EndOfFile: 180 736, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5597009 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\winmm.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5598040 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\winmm.dll SUCCESS 13:39:12,5599375 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\winmm.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5600399 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\winmm.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5600467 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\winmm.dll SUCCESS AllocationSize: 184 320, EndOfFile: 180 736, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5600585 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\winmm.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5605760 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ole32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5606919 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\ole32.dll SUCCESS AllocationSize: 1 286 144, EndOfFile: 1 284 608, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5607886 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\ole32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5609025 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ole32.dll SUCCESS 13:39:12,5610993 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ole32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5612029 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ole32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5612099 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\ole32.dll SUCCESS AllocationSize: 1 286 144, EndOfFile: 1 284 608, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5612216 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ole32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5613786 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msvcrt.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5614811 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msvcrt.dll SUCCESS AllocationSize: 344 064, EndOfFile: 343 040, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5615768 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msvcrt.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5616852 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msvcrt.dll SUCCESS 13:39:12,5618466 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msvcrt.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5619502 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msvcrt.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5619571 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msvcrt.dll SUCCESS AllocationSize: 344 064, EndOfFile: 343 040, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5619688 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msvcrt.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5621242 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\oleaut32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5622264 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\oleaut32.dll SUCCESS AllocationSize: 552 960, EndOfFile: 550 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5623230 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\oleaut32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5624347 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\oleaut32.dll SUCCESS 13:39:12,5625796 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\oleaut32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5626899 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\oleaut32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5626968 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\oleaut32.dll SUCCESS AllocationSize: 552 960, EndOfFile: 550 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5627086 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\oleaut32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5628645 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msacm32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5629669 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msacm32.dll SUCCESS AllocationSize: 73 728, EndOfFile: 72 192, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5630629 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msacm32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5631652 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msacm32.dll SUCCESS 13:39:12,5633239 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msacm32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5634271 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msacm32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5634342 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msacm32.dll SUCCESS AllocationSize: 73 728, EndOfFile: 72 192, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5634460 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msacm32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5636428 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\version.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5637868 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\version.dll SUCCESS AllocationSize: 20 480, EndOfFile: 18 944, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5638848 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\version.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5640007 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\version.dll SUCCESS 13:39:12,5641433 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\version.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5642464 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\version.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5642533 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\version.dll SUCCESS AllocationSize: 20 480, EndOfFile: 18 944, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5642650 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\version.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5645124 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shell32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5646185 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shell32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5646256 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\shell32.dll SUCCESS AllocationSize: 12 931 072, EndOfFile: 12 930 560, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5646372 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shell32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5647819 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shlwapi.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5648908 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shlwapi.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5648981 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\shlwapi.dll SUCCESS AllocationSize: 499 712, EndOfFile: 499 200, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5649097 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shlwapi.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5650656 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\userenv.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5651682 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\userenv.dll SUCCESS AllocationSize: 733 184, EndOfFile: 731 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5652648 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\userenv.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5653679 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\userenv.dll SUCCESS 13:39:12,5655040 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\userenv.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5656062 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\userenv.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5656131 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\userenv.dll SUCCESS AllocationSize: 733 184, EndOfFile: 731 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5656251 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\userenv.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5657674 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\uxtheme.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5658704 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\uxtheme.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5658773 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\uxtheme.dll SUCCESS AllocationSize: 204 800, EndOfFile: 204 288, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5658886 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\uxtheme.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5660431 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5661449 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\imm32.dll SUCCESS AllocationSize: 110 592, EndOfFile: 110 080, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5662404 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\imm32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5663412 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:12,5664748 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5665790 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5665859 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\imm32.dll SUCCESS AllocationSize: 110 592, EndOfFile: 110 080, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5665979 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5667866 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\lpk.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5668903 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\lpk.dll SUCCESS AllocationSize: 24 576, EndOfFile: 22 016, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5669870 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\lpk.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5670895 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\lpk.dll SUCCESS 13:39:12,5672280 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\lpk.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5673410 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\lpk.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5673481 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\lpk.dll SUCCESS AllocationSize: 24 576, EndOfFile: 22 016, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5673601 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\lpk.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5675341 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\usp10.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5676651 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\usp10.dll SUCCESS AllocationSize: 409 600, EndOfFile: 406 528, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5677617 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\usp10.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5678645 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\usp10.dll SUCCESS 13:39:12,5679983 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\usp10.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5681106 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\usp10.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5681177 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\usp10.dll SUCCESS AllocationSize: 409 600, EndOfFile: 406 528, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5681294 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\usp10.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5682740 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\wbsys.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5683772 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\wbsys.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5683840 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\wbsys.dll SUCCESS AllocationSize: 45 056, EndOfFile: 42 672, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5683954 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\wbsys.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5685564 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\sortkey.nls SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5686582 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\sortkey.nls SUCCESS AllocationSize: 266 240, EndOfFile: 262 148, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5687541 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\sortkey.nls SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5689441 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\sortkey.nls SUCCESS 13:39:12,5690829 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\sortkey.nls SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5691855 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\sortkey.nls SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5691922 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\sortkey.nls SUCCESS AllocationSize: 266 240, EndOfFile: 262 148, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5692040 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\sortkey.nls SUCCESS SyncType: SyncTypeOther 13:39:12,5694062 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5695188 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS AllocationSize: 1 056 768, EndOfFile: 1 054 208, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5696742 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5697795 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS 13:39:12,5699435 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5700471 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5700547 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS AllocationSize: 1 056 768, EndOfFile: 1 054 208, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5700670 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5701684 SexyCity.exe 564 CreateFile C:\WINDOWS\WINDOWSSHELL.MANIFEST SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5702160 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5702560 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WindowsShell.Manifest SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5703206 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS CreationTime: 28/01/2008 19:23:11, LastAccessTime: 17/02/2011 13:38:43, LastWriteTime: 24/11/2004 21:03:04, ChangeTime: 15/02/2011 20:22:27, FileAttributes: RHA 13:39:12,5703837 SexyCity.exe 564 ReadFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Offset: 0, Length: 749 13:39:12,5704662 SexyCity.exe 564 CloseFile C:\WINDOWS\WindowsShell.Manifest SUCCESS 13:39:12,5705351 SexyCity.exe 564 CreateFile C:\WINDOWS\WINDOWSSHELL.MANIFEST SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5705824 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WindowsShell.Manifest SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5705888 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5705999 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WindowsShell.Manifest SUCCESS SyncType: SyncTypeOther 13:39:12,5707567 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5708594 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comctl32.dll SUCCESS AllocationSize: 618 496, EndOfFile: 617 472, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5709556 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\comctl32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5710738 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comctl32.dll SUCCESS 13:39:12,5712088 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5713114 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comctl32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5713181 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comctl32.dll SUCCESS AllocationSize: 618 496, EndOfFile: 617 472, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5713296 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comctl32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5714730 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5715490 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS AllocationSize: 413 696, EndOfFile: 413 008, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5716440 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5717268 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS 13:39:12,5718349 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5719113 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5719182 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS AllocationSize: 413 696, EndOfFile: 413 008, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5719302 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5720659 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5721687 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS AllocationSize: 5 816 320, EndOfFile: 5 815 296, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5722381 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5724137 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:12,5725383 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5726237 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5726310 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS AllocationSize: 5 816 320, EndOfFile: 5 815 296, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5727590 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5729308 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5730332 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS AllocationSize: 634 880, EndOfFile: 632 656, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5731287 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5732313 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS 13:39:12,5733673 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5734742 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5734812 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS AllocationSize: 634 880, EndOfFile: 632 656, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5734929 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5736274 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\MACHINE.CONFIG SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5737816 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS AllocationSize: 28 672, EndOfFile: 25 605, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5738534 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5739284 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS CreationTime: 23/09/2005 06:28:48, LastAccessTime: 17/02/2011 11:07:51, LastWriteTime: 16/02/2011 13:33:09, ChangeTime: 16/02/2011 13:33:09, FileAttributes: A 13:39:12,5740040 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 0, Length: 1 024 13:39:12,5740209 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:12,5840332 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS 13:39:12,5857631 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\MACHINE.CONFIG SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5858686 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5858759 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS AllocationSize: 28 672, EndOfFile: 25 605, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5858881 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS SyncType: SyncTypeOther 13:39:12,5860095 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\SECURITY.CONFIG.CCH SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5860961 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS AllocationSize: 4 096, EndOfFile: 2 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5861403 SexyCity.exe 564 FileSystemControl C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5862005 SexyCity.exe 564 QueryBasicInformationFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS CreationTime: 21/07/2008 20:39:52, LastAccessTime: 17/02/2011 11:07:54, LastWriteTime: 08/12/2010 18:20:30, ChangeTime: 08/12/2010 18:20:30, FileAttributes: A 13:39:12,5862548 SexyCity.exe 564 ReadFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS Offset: 0, Length: 1 024 13:39:12,5862710 SexyCity.exe 564 ReadFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS Offset: 0, Length: 2 912, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:12,5885395 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS 13:39:12,5886208 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\SECURITY.CONFIG.CCH SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5886749 SexyCity.exe 564 CreateFileMapping C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5886820 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS AllocationSize: 4 096, EndOfFile: 2 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5886942 SexyCity.exe 564 CreateFileMapping C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS SyncType: SyncTypeOther 13:39:12,5888738 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\MSCORLIB.NI.DLL SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5890367 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5890446 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS AllocationSize: 11 485 184, EndOfFile: 11 485 184, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5891484 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5893147 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\rpcss.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5894497 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\rpcss.dll SUCCESS AllocationSize: 401 408, EndOfFile: 397 824, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5895475 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\rpcss.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5896557 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\rpcss.dll SUCCESS 13:39:12,5897897 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\rpcss.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5898919 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\rpcss.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5898989 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\rpcss.dll SUCCESS AllocationSize: 401 408, EndOfFile: 397 824, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5899108 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\rpcss.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5900672 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msctf.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5901695 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msctf.dll SUCCESS AllocationSize: 294 912, EndOfFile: 294 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5902654 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msctf.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5903682 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msctf.dll SUCCESS 13:39:12,5905022 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msctf.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5906041 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msctf.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5906109 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msctf.dll SUCCESS AllocationSize: 294 912, EndOfFile: 294 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5906227 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msctf.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5907802 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\l_intl.nls SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5909106 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\l_intl.nls SUCCESS AllocationSize: 8 192, EndOfFile: 7 046, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5910072 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\l_intl.nls SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5911103 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\l_intl.nls SUCCESS 13:39:12,5912447 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\l_intl.nls SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5913481 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\l_intl.nls SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5913547 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\l_intl.nls SUCCESS AllocationSize: 8 192, EndOfFile: 7 046, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5914535 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\l_intl.nls SUCCESS SyncType: SyncTypeOther 13:39:12,5916051 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\MICROSOFT.VISUALBASIC.DLL SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5917501 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5917568 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS AllocationSize: 659 456, EndOfFile: 659 456, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5918572 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5919911 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5920868 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS AllocationSize: 368 640, EndOfFile: 367 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5921563 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5922331 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS 13:39:12,5923398 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5924162 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5924227 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS AllocationSize: 368 640, EndOfFile: 367 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5924935 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5926441 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\SYSTEM.NI.DLL SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5927667 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5927736 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS AllocationSize: 7 868 416, EndOfFile: 7 867 392, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5928727 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5930261 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\SYSTEM.DRAWING.NI.DLL SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5931284 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5931354 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS AllocationSize: 1 589 248, EndOfFile: 1 587 200, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5932077 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5933331 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\SYSTEM.WINDOWS.FORMS.NI.DLL SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5934300 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5934372 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS AllocationSize: 12 431 360, EndOfFile: 12 428 800, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5935105 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5936581 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\SYSTEM.RUNTIME.REMOTING.DLL SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5937775 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5937843 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS AllocationSize: 303 104, EndOfFile: 303 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5938811 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5940261 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.DLL SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5941458 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5941530 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS AllocationSize: 5 025 792, EndOfFile: 5 025 792, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5942786 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5944596 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5945644 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5946595 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5947633 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:12,5949063 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5950082 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5950150 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5950268 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeOther 13:39:12,5951816 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\apphelp.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5952829 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\apphelp.dll SUCCESS AllocationSize: 126 976, EndOfFile: 126 976, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5953781 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\apphelp.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5955032 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\apphelp.dll SUCCESS 13:39:12,5956368 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\apphelp.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5957389 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\apphelp.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5957456 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\apphelp.dll SUCCESS AllocationSize: 126 976, EndOfFile: 126 976, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5957572 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\apphelp.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5959196 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\secur32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5960209 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\secur32.dll SUCCESS AllocationSize: 57 344, EndOfFile: 55 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5961280 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\secur32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5962354 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\secur32.dll SUCCESS 13:39:12,5963870 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\secur32.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5964928 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\secur32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5964999 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\secur32.dll SUCCESS AllocationSize: 57 344, EndOfFile: 55 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5965119 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\secur32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5966664 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\clbcatq.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5967693 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\clbcatq.dll SUCCESS AllocationSize: 499 712, EndOfFile: 498 688, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5968670 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\clbcatq.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5969736 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\clbcatq.dll SUCCESS 13:39:12,5971096 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\clbcatq.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5972114 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\clbcatq.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5972185 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\clbcatq.dll SUCCESS AllocationSize: 499 712, EndOfFile: 498 688, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5972302 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\clbcatq.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5973868 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comres.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5974887 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comres.dll SUCCESS AllocationSize: 851 968, EndOfFile: 851 968, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5975938 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\comres.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5976966 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comres.dll SUCCESS 13:39:12,5978341 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comres.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5979355 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comres.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5979420 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comres.dll SUCCESS AllocationSize: 851 968, EndOfFile: 851 968, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5979534 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comres.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5980552 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000001C.CLB SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5981039 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS AllocationSize: 24 576, EndOfFile: 23 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5981445 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Registration\R00000000001c.clb SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5981895 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS CreationTime: 15/02/2011 20:36:08, LastAccessTime: 17/02/2011 13:38:43, LastWriteTime: 09/06/2007 10:54:45, ChangeTime: 08/09/2007 16:02:07, FileAttributes: A 13:39:12,5982365 SexyCity.exe 564 ReadFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS Offset: 0, Length: 1 024 13:39:12,5983003 SexyCity.exe 564 CloseFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS 13:39:12,5983712 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000001C.CLB SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5984188 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Registration\R00000000001c.clb SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5984253 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS AllocationSize: 24 576, EndOfFile: 23 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5984367 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Registration\R00000000001c.clb SUCCESS SyncType: SyncTypeOther 13:39:12,5986249 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5987894 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS AllocationSize: 1 724 416, EndOfFile: 1 724 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5988884 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5990954 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS 13:39:12,5992988 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,5994060 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,5994134 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS AllocationSize: 1 724 416, EndOfFile: 1 724 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5994262 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS SyncType: SyncTypeOther 13:39:12,5995849 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,5996570 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS AllocationSize: 98 304, EndOfFile: 97 392, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,5998211 SexyCity.exe 564 FileSystemControl C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,5998893 SexyCity.exe 564 QueryBasicInformationFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS CreationTime: 11/06/2007 16:13:01, LastAccessTime: 15/02/2011 14:24:13, LastWriteTime: 15/02/2011 14:24:13, ChangeTime: 15/02/2011 14:24:13, FileAttributes: A 13:39:12,5999402 SexyCity.exe 564 ReadFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Offset: 0, Length: 1 024 13:39:12,5999569 SexyCity.exe 564 ReadFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:12,6077139 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS 13:39:12,6084745 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,6085428 SexyCity.exe 564 CreateFileMapping C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,6085520 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS AllocationSize: 98 304, EndOfFile: 97 392, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6085768 SexyCity.exe 564 CreateFileMapping C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS SyncType: SyncTypeOther 13:39:12,6087401 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,6088428 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6089372 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,6090384 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS 13:39:12,6091704 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,6092714 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahoma.ttf SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,6092783 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6092900 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahoma.ttf SUCCESS SyncType: SyncTypeOther 13:39:12,6094453 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,6095492 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6096443 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,6097452 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS 13:39:12,6098777 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,6099793 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,6099861 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6099980 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS SyncType: SyncTypeOther 13:39:12,6101309 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,6102256 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS AllocationSize: 28 672, EndOfFile: 27 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6102942 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,6103693 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS 13:39:12,6104823 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,6105582 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,6105646 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS AllocationSize: 28 672, EndOfFile: 27 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6106360 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeOther 13:39:12,6108605 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,6110221 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS AllocationSize: 421 888, EndOfFile: 420 864, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6111183 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,6112205 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS 13:39:12,6113542 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,6114580 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,6114645 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS AllocationSize: 421 888, EndOfFile: 420 864, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6115630 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS SyncType: SyncTypeOther 13:39:12,6116665 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DIASYMREADER.DLL SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,6117320 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS AllocationSize: 577 536, EndOfFile: 575 496, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6117730 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,6118207 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS 13:39:12,6119003 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DIASYMREADER.DLL SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,6119489 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,6119555 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS AllocationSize: 577 536, EndOfFile: 575 496, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6119994 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeOther 13:39:12,6122164 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,6124030 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:12,6124101 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS AllocationSize: 4 546 560, EndOfFile: 4 546 560, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,6125601 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS SyncType: SyncTypeOther 13:39:12,6127804 SexyCity.exe 564 ReadFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Offset: 1 761 280, Length: 172 032, I/O Flags: Non-cached, Paging I/O 13:39:12,6128152 SexyCity.exe 564 ReadFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Offset: 2 097 152, Length: 512, I/O Flags: Non-cached, Paging I/O 13:39:12,6128270 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6128437 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6128619 SexyCity.exe 564 ReadFile C:\WINDOWS\system32\l_intl.nls SUCCESS Offset: 0, Length: 7 046, I/O Flags: Non-cached, Paging I/O 13:39:12,6128794 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Offset: 0, Length: 28 672, I/O Flags: Non-cached, Paging I/O 13:39:12,6128951 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6129112 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6129271 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6129426 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6129587 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6129756 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6129898 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS Offset: 4 702 208, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6130017 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS Offset: 5 017 600, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6130156 SexyCity.exe 564 ReadFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Offset: 69 632, Length: 27 760, I/O Flags: Non-cached, Paging I/O 13:39:12,6130283 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6130449 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Offset: 0, Length: 217 088, I/O Flags: Non-cached, Paging I/O 13:39:12,6130631 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6130796 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,6130944 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Offset: 3 989 504, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7301899 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ntdll.dll SUCCESS 13:39:12,7303524 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\mscoree.dll SUCCESS 13:39:12,7304711 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\kernel32.dll SUCCESS 13:39:12,7306113 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\unicode.nls SUCCESS 13:39:12,7307236 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\locale.nls SUCCESS 13:39:12,7308522 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\sorttbls.nls SUCCESS 13:39:12,7309646 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ctype.nls SUCCESS 13:39:12,7310301 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS 13:39:12,7311666 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shimeng.dll SUCCESS 13:39:12,7312832 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:12,7313914 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:12,7315071 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\user32.dll SUCCESS 13:39:12,7316165 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\gdi32.dll SUCCESS 13:39:12,7317273 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\advapi32.dll SUCCESS 13:39:12,7318365 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS 13:39:12,7319448 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\winmm.dll SUCCESS 13:39:12,7320524 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ole32.dll SUCCESS 13:39:12,7321602 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msvcrt.dll SUCCESS 13:39:12,7322679 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\oleaut32.dll SUCCESS 13:39:12,7323935 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msacm32.dll SUCCESS 13:39:12,7325086 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\version.dll SUCCESS 13:39:12,7326176 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shell32.dll SUCCESS 13:39:12,7327257 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shlwapi.dll SUCCESS 13:39:12,7328331 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\userenv.dll SUCCESS 13:39:12,7329405 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\uxtheme.dll SUCCESS 13:39:12,7330486 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:12,7331827 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\lpk.dll SUCCESS 13:39:12,7333419 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\usp10.dll SUCCESS 13:39:12,7334529 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\wbsys.dll SUCCESS 13:39:12,7335674 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\sortkey.nls SUCCESS 13:39:12,7336817 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS 13:39:12,7337379 SexyCity.exe 564 CloseFile C:\WINDOWS\WindowsShell.Manifest SUCCESS 13:39:12,7338461 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comctl32.dll SUCCESS 13:39:12,7339347 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS 13:39:12,7340365 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:12,7341333 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS 13:39:12,7342167 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS 13:39:12,7342784 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS 13:39:12,7343930 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS 13:39:12,7344962 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\rpcss.dll SUCCESS 13:39:12,7346032 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msctf.dll SUCCESS 13:39:12,7347110 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\l_intl.nls SUCCESS 13:39:12,7348053 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS 13:39:12,7348760 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS 13:39:12,7349699 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS 13:39:12,7350405 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS 13:39:12,7351269 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS 13:39:12,7352625 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS 13:39:12,7353598 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS 13:39:12,7354557 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:12,7355643 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\apphelp.dll SUCCESS 13:39:12,7356715 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\secur32.dll SUCCESS 13:39:12,7357797 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\clbcatq.dll SUCCESS 13:39:12,7358876 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comres.dll SUCCESS 13:39:12,7359443 SexyCity.exe 564 CloseFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS 13:39:12,7360534 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS 13:39:12,7361192 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS 13:39:12,7362278 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS 13:39:12,7363343 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS 13:39:12,7364176 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS 13:39:12,7365169 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS 13:39:12,7365617 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS 13:39:12,7367058 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS 13:39:12,7368671 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ntdll.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7369706 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\ntdll.dll SUCCESS AllocationSize: 733 184, EndOfFile: 733 184, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7370673 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\ntdll.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7371889 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ntdll.dll SUCCESS 13:39:12,7373244 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ntdll.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7374389 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ntdll.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7374668 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ntdll.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7376192 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\mscoree.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7377215 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\mscoree.dll SUCCESS AllocationSize: 299 008, EndOfFile: 297 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7378177 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\mscoree.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7379220 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\mscoree.dll SUCCESS 13:39:12,7380546 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\mscoree.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7381563 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\mscoree.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7381813 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\mscoree.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7383320 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\kernel32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7384442 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\kernel32.dll SUCCESS AllocationSize: 1 052 672, EndOfFile: 1 049 600, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7385403 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\kernel32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7386439 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\kernel32.dll SUCCESS 13:39:12,7387766 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\kernel32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7388782 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\kernel32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7389050 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\kernel32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7389955 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7390447 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7390747 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeOther 13:39:12,7392232 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shimeng.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7393256 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\shimeng.dll SUCCESS AllocationSize: 65 536, EndOfFile: 65 536, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7394476 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\shimeng.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7395556 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shimeng.dll SUCCESS 13:39:12,7396899 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shimeng.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7397918 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shimeng.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7398164 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shimeng.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7399633 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7400624 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7401560 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7402627 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:12,7404913 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7405917 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7406199 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7407706 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\user32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7408730 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\user32.dll SUCCESS AllocationSize: 581 632, EndOfFile: 578 560, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7409694 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\user32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7410722 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\user32.dll SUCCESS 13:39:12,7412052 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\user32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7413078 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\user32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7413333 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\user32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7414808 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\gdi32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7415822 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\gdi32.dll SUCCESS AllocationSize: 282 624, EndOfFile: 282 624, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7416784 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\gdi32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7417811 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\gdi32.dll SUCCESS 13:39:12,7419130 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\gdi32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7420150 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\gdi32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7420390 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\gdi32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7421865 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\advapi32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7422887 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\advapi32.dll SUCCESS AllocationSize: 688 128, EndOfFile: 685 056, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7423845 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\advapi32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7424861 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\advapi32.dll SUCCESS 13:39:12,7426187 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\advapi32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7427477 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\advapi32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7427740 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\advapi32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7429215 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7430229 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS AllocationSize: 585 728, EndOfFile: 582 656, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7431184 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\rpcrt4.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7432208 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS 13:39:12,7433540 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7434556 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\rpcrt4.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7434808 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\rpcrt4.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7436278 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\winmm.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7437291 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\winmm.dll SUCCESS AllocationSize: 184 320, EndOfFile: 180 736, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7438246 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\winmm.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7439258 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\winmm.dll SUCCESS 13:39:12,7440582 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\winmm.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7441599 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\winmm.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7441845 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\winmm.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7443440 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ole32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7444777 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\ole32.dll SUCCESS AllocationSize: 1 286 144, EndOfFile: 1 284 608, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7445749 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\ole32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7446895 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ole32.dll SUCCESS 13:39:12,7448967 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\ole32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7450022 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ole32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7450292 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\ole32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7451827 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msvcrt.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7453304 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msvcrt.dll SUCCESS AllocationSize: 344 064, EndOfFile: 343 040, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7454274 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msvcrt.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7455294 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msvcrt.dll SUCCESS 13:39:12,7456641 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msvcrt.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7457666 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msvcrt.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7457909 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msvcrt.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7459404 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\oleaut32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7460431 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\oleaut32.dll SUCCESS AllocationSize: 552 960, EndOfFile: 550 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7461396 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\oleaut32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7462701 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\oleaut32.dll SUCCESS 13:39:12,7464064 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\oleaut32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7465104 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\oleaut32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7465360 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\oleaut32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7467022 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msacm32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7468070 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msacm32.dll SUCCESS AllocationSize: 73 728, EndOfFile: 72 192, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7469028 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msacm32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7470041 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msacm32.dll SUCCESS 13:39:12,7471388 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msacm32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7472770 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msacm32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7473019 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msacm32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7474527 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\version.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7475550 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\version.dll SUCCESS AllocationSize: 20 480, EndOfFile: 18 944, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7476516 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\version.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7477531 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\version.dll SUCCESS 13:39:12,7478860 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\version.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7479881 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\version.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7480118 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\version.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7481541 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shell32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7482581 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shell32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7483322 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shell32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7484914 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shlwapi.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7485965 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shlwapi.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7486230 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shlwapi.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7487726 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\userenv.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7488756 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\userenv.dll SUCCESS AllocationSize: 733 184, EndOfFile: 731 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7489801 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\userenv.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7490810 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\userenv.dll SUCCESS 13:39:12,7492240 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\userenv.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7493261 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\userenv.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7493519 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\userenv.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7494943 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\uxtheme.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7495971 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\uxtheme.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7496212 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\uxtheme.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7497683 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7498698 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\imm32.dll SUCCESS AllocationSize: 110 592, EndOfFile: 110 080, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7499651 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\imm32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7500663 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:12,7502091 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7503312 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7503559 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7505045 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\lpk.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7506061 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\lpk.dll SUCCESS AllocationSize: 24 576, EndOfFile: 22 016, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7507024 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\lpk.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7508041 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\lpk.dll SUCCESS 13:39:12,7509370 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\lpk.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7510393 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\lpk.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7510631 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\lpk.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7512100 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\usp10.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7513119 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\usp10.dll SUCCESS AllocationSize: 409 600, EndOfFile: 406 528, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7514079 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\usp10.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7515236 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\usp10.dll SUCCESS 13:39:12,7516582 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\usp10.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7517614 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\usp10.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7517868 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\usp10.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7519291 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\wbsys.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7520386 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\wbsys.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7520632 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\wbsys.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7522212 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7523263 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS AllocationSize: 1 056 768, EndOfFile: 1 054 208, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7524229 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7525249 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS 13:39:12,7526601 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7527633 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7527972 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7529485 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7530610 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comctl32.dll SUCCESS AllocationSize: 618 496, EndOfFile: 617 472, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7531591 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\comctl32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7532617 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comctl32.dll SUCCESS 13:39:12,7533958 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7534979 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comctl32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7535231 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comctl32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7536513 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7537283 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS AllocationSize: 413 696, EndOfFile: 413 008, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7538370 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7539186 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS 13:39:12,7540332 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7541102 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7541356 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7542660 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7543421 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS AllocationSize: 5 816 320, EndOfFile: 5 815 296, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7544108 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7544873 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:12,7545938 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7546700 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7546769 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS AllocationSize: 5 816 320, EndOfFile: 5 815 296, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7546848 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7548337 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7549967 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7550988 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS AllocationSize: 634 880, EndOfFile: 632 656, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7551937 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7553471 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS 13:39:12,7554843 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7555878 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7556142 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7557769 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\MSCORLIB.NI.DLL SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7558839 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7558910 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS AllocationSize: 11 485 184, EndOfFile: 11 485 184, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7558985 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7561189 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7562732 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msctf.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7563960 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msctf.dll SUCCESS AllocationSize: 294 912, EndOfFile: 294 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7564944 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msctf.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7566238 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msctf.dll SUCCESS 13:39:12,7567677 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msctf.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7568711 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msctf.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7568958 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msctf.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7570518 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\MICROSOFT.VISUALBASIC.DLL SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7571553 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7571620 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS AllocationSize: 659 456, EndOfFile: 659 456, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7571692 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7572936 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7574193 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7574955 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS AllocationSize: 368 640, EndOfFile: 367 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7575680 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7576552 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS 13:39:12,7577643 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7578406 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7578471 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS AllocationSize: 368 640, EndOfFile: 367 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7578540 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7579881 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7581415 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\SYSTEM.NI.DLL SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7582456 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7582524 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS AllocationSize: 7 868 416, EndOfFile: 7 867 392, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7582598 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7584450 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7585688 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\SYSTEM.DRAWING.NI.DLL SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7586470 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7586540 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS AllocationSize: 1 589 248, EndOfFile: 1 587 200, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7586614 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7587686 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7588948 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\SYSTEM.WINDOWS.FORMS.NI.DLL SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7589755 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7589823 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS AllocationSize: 12 431 360, EndOfFile: 12 428 800, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7589894 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7591813 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7593353 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\SYSTEM.RUNTIME.REMOTING.DLL SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7594420 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7594490 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS AllocationSize: 303 104, EndOfFile: 303 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7594562 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7595766 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7597219 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.DLL SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7598250 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7598315 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS AllocationSize: 5 025 792, EndOfFile: 5 025 792, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7598384 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7600048 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7601559 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7602579 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7603541 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7604568 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:12,7605899 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7606922 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7607164 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeOther 13:39:12,7608642 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\apphelp.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7609660 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\apphelp.dll SUCCESS AllocationSize: 126 976, EndOfFile: 126 976, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7610623 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\apphelp.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7611639 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\apphelp.dll SUCCESS 13:39:12,7612968 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\apphelp.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7613981 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\apphelp.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7614221 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\apphelp.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7615696 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\secur32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7616714 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\secur32.dll SUCCESS AllocationSize: 57 344, EndOfFile: 55 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7617681 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\secur32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7618894 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\secur32.dll SUCCESS 13:39:12,7620261 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\secur32.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7621297 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\secur32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7621538 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\secur32.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7623034 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\clbcatq.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7624061 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\clbcatq.dll SUCCESS AllocationSize: 499 712, EndOfFile: 498 688, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7625027 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\clbcatq.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7626098 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\clbcatq.dll SUCCESS 13:39:12,7627438 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\clbcatq.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7628605 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\clbcatq.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7628849 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\clbcatq.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7630329 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comres.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7631345 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comres.dll SUCCESS AllocationSize: 851 968, EndOfFile: 851 968, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7632300 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\comres.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7633321 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comres.dll SUCCESS 13:39:12,7634871 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comres.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7635903 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comres.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7636166 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comres.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7637732 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7638768 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS AllocationSize: 1 724 416, EndOfFile: 1 724 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7639725 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7640743 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS 13:39:12,7642082 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7643138 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7643530 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7644883 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7645640 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS AllocationSize: 28 672, EndOfFile: 27 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7646329 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7647082 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS 13:39:12,7648213 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7648974 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7649041 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS AllocationSize: 28 672, EndOfFile: 27 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7649112 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7650045 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7651021 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DIASYMREADER.DLL SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:12,7651537 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS AllocationSize: 577 536, EndOfFile: 575 496, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7651997 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:12,7652555 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS 13:39:12,7653369 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DIASYMREADER.DLL SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7653852 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7653917 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS AllocationSize: 577 536, EndOfFile: 575 496, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7653986 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7654696 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7656695 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:12,7658254 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:12,7658324 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS AllocationSize: 4 546 560, EndOfFile: 4 546 560, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:12,7658393 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7660558 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS SyncType: SyncTypeOther 13:39:12,7663059 SexyCity.exe 564 ReadFile C:\WINDOWS\system32\ntdll.dll SUCCESS Offset: 275 456, Length: 40 960, I/O Flags: Non-cached, Paging I/O 13:39:12,7663551 SexyCity.exe 564 ReadFile C:\WINDOWS\system32\mscoree.dll SUCCESS Offset: 1 024, Length: 262 144, I/O Flags: Non-cached, Paging I/O 13:39:12,7663685 SexyCity.exe 564 ReadFile C:\WINDOWS\system32\mscoree.dll SUCCESS Offset: 263 168, Length: 12 800, I/O Flags: Non-cached, Paging I/O 13:39:12,7663798 SexyCity.exe 564 ReadFile C:\WINDOWS\system32\kernel32.dll SUCCESS Offset: 279 552, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7664154 SexyCity.exe 564 ReadFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Offset: 1 024, Length: 45 056, I/O Flags: Non-cached, Paging I/O 13:39:12,7664264 SexyCity.exe 564 ReadFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Offset: 1 762 304, Length: 232 960, I/O Flags: Non-cached, Paging I/O 13:39:12,7664369 SexyCity.exe 564 ReadFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Offset: 1 995 264, Length: 512, I/O Flags: Non-cached, Paging I/O 13:39:12,7664461 SexyCity.exe 564 ReadFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Offset: 2 097 152, Length: 512, I/O Flags: Non-cached, Paging I/O 13:39:12,7664707 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 1 024, Length: 372 736, I/O Flags: Non-cached, Paging I/O 13:39:12,7664836 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 373 760, Length: 11 776, I/O Flags: Non-cached, Paging I/O 13:39:12,7664926 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 385 536, Length: 2 048, I/O Flags: Non-cached, Paging I/O 13:39:12,7667603 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 1 024, Length: 2 043 904, I/O Flags: Non-cached, Paging I/O 13:39:12,7668011 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 2 249 728, Length: 1 024 000, I/O Flags: Non-cached, Paging I/O 13:39:12,7668273 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 4 289 536, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7668377 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 4 535 296, Length: 217 088, I/O Flags: Non-cached, Paging I/O 13:39:12,7668503 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 4 883 456, Length: 624 640, I/O Flags: Non-cached, Paging I/O 13:39:12,7668698 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 5 508 096, Length: 512, I/O Flags: Non-cached, Paging I/O 13:39:12,7668805 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 5 508 608, Length: 68 608, I/O Flags: Non-cached, Paging I/O 13:39:12,7668910 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 5 577 216, Length: 2 048, I/O Flags: Non-cached, Paging I/O 13:39:12,7669232 SexyCity.exe 564 ReadFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7669348 SexyCity.exe 564 ReadFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Offset: 4 096, Length: 372 736, I/O Flags: Non-cached, Paging I/O 13:39:12,7669494 SexyCity.exe 564 ReadFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Offset: 409 600, Length: 176 128, I/O Flags: Non-cached, Paging I/O 13:39:12,7669624 SexyCity.exe 564 ReadFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Offset: 585 728, Length: 20 480, I/O Flags: Non-cached, Paging I/O 13:39:12,7669733 SexyCity.exe 564 ReadFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Offset: 606 208, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7672135 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 512, Length: 1 536 000, I/O Flags: Non-cached, Paging I/O 13:39:12,7672520 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 1 566 208, Length: 110 592, I/O Flags: Non-cached, Paging I/O 13:39:12,7672630 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 1 690 624, Length: 978 944, I/O Flags: Non-cached, Paging I/O 13:39:12,7672911 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 2 948 096, Length: 159 744, I/O Flags: Non-cached, Paging I/O 13:39:12,7673049 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 3 767 296, Length: 1 957 888, I/O Flags: Non-cached, Paging I/O 13:39:12,7673511 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 6 827 008, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7673623 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 7 007 232, Length: 176 128, I/O Flags: Non-cached, Paging I/O 13:39:12,7673769 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 7 416 832, Length: 8 192, I/O Flags: Non-cached, Paging I/O 13:39:12,7673879 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 8 727 552, Length: 323 584, I/O Flags: Non-cached, Paging I/O 13:39:12,7674051 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 9 194 496, Length: 585 728, I/O Flags: Non-cached, Paging I/O 13:39:12,7674271 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 10 083 328, Length: 221 184, I/O Flags: Non-cached, Paging I/O 13:39:12,7674416 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 11 070 464, Length: 1 536, I/O Flags: Non-cached, Paging I/O 13:39:12,7674765 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Offset: 4 096, Length: 24 576, I/O Flags: Non-cached, Paging I/O 13:39:12,7674895 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Offset: 237 568, Length: 344 064, I/O Flags: Non-cached, Paging I/O 13:39:12,7675054 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Offset: 581 632, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7675169 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Offset: 585 728, Length: 69 632, I/O Flags: Non-cached, Paging I/O 13:39:12,7675280 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Offset: 655 360, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7675687 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Offset: 1 024, Length: 349 184, I/O Flags: Non-cached, Paging I/O 13:39:12,7675850 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Offset: 350 208, Length: 1 024, I/O Flags: Non-cached, Paging I/O 13:39:12,7675962 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Offset: 351 232, Length: 2 048, I/O Flags: Non-cached, Paging I/O 13:39:12,7676522 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 512, Length: 823 296, I/O Flags: Non-cached, Paging I/O 13:39:12,7676798 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 973 312, Length: 102 400, I/O Flags: Non-cached, Paging I/O 13:39:12,7676909 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 1 084 928, Length: 172 032, I/O Flags: Non-cached, Paging I/O 13:39:12,7677049 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 1 416 704, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7677161 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 1 588 736, Length: 167 936, I/O Flags: Non-cached, Paging I/O 13:39:12,7677297 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 2 006 528, Length: 151 552, I/O Flags: Non-cached, Paging I/O 13:39:12,7677436 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 2 313 728, Length: 233 472, I/O Flags: Non-cached, Paging I/O 13:39:12,7677580 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 2 706 944, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7677697 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 2 924 032, Length: 188 416, I/O Flags: Non-cached, Paging I/O 13:39:12,7677837 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 3 264 000, Length: 65 536, I/O Flags: Non-cached, Paging I/O 13:39:12,7677955 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 3 542 528, Length: 204 800, I/O Flags: Non-cached, Paging I/O 13:39:12,7678098 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 5 066 240, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7678219 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 6 069 760, Length: 208 896, I/O Flags: Non-cached, Paging I/O 13:39:12,7678358 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 6 913 536, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7678475 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Offset: 7 597 568, Length: 512, I/O Flags: Non-cached, Paging I/O 13:39:12,7678788 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Offset: 512, Length: 192 512, I/O Flags: Non-cached, Paging I/O 13:39:12,7678944 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Offset: 214 528, Length: 16 384, I/O Flags: Non-cached, Paging I/O 13:39:12,7679063 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Offset: 256 512, Length: 516 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7679261 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Offset: 1 116 672, Length: 12 288, I/O Flags: Non-cached, Paging I/O 13:39:12,7679380 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Offset: 1 280 512, Length: 250 368, I/O Flags: Non-cached, Paging I/O 13:39:12,7680286 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 512, Length: 229 376, I/O Flags: Non-cached, Paging I/O 13:39:12,7680457 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 705 024, Length: 86 016, I/O Flags: Non-cached, Paging I/O 13:39:12,7680580 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 1 094 144, Length: 20 480, I/O Flags: Non-cached, Paging I/O 13:39:12,7680705 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 1 245 696, Length: 86 016, I/O Flags: Non-cached, Paging I/O 13:39:12,7680828 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 1 518 592, Length: 102 400, I/O Flags: Non-cached, Paging I/O 13:39:12,7680955 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 1 759 232, Length: 765 952, I/O Flags: Non-cached, Paging I/O 13:39:12,7681223 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 3 176 448, Length: 204 800, I/O Flags: Non-cached, Paging I/O 13:39:12,7681377 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 3 590 144, Length: 53 248, I/O Flags: Non-cached, Paging I/O 13:39:12,7681504 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 3 782 656, Length: 176 128, I/O Flags: Non-cached, Paging I/O 13:39:12,7681661 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 4 229 120, Length: 172 032, I/O Flags: Non-cached, Paging I/O 13:39:12,7681818 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 4 663 296, Length: 454 656, I/O Flags: Non-cached, Paging I/O 13:39:12,7682085 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 5 277 696, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7682201 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 5 535 744, Length: 61 440, I/O Flags: Non-cached, Paging I/O 13:39:12,7682318 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 5 752 832, Length: 61 440, I/O Flags: Non-cached, Paging I/O 13:39:12,7682435 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 7 583 744, Length: 94 208, I/O Flags: Non-cached, Paging I/O 13:39:12,7682551 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 9 218 048, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7682669 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 10 020 864, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7682787 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 10 651 648, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7682908 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 10 852 352, Length: 20 480, I/O Flags: Non-cached, Paging I/O 13:39:12,7683025 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 11 077 632, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7683142 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Offset: 12 019 712, Length: 3 072, I/O Flags: Non-cached, Paging I/O 13:39:12,7683336 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Offset: 4 096, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7683451 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Offset: 139 264, Length: 151 552, I/O Flags: Non-cached, Paging I/O 13:39:12,7683580 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Offset: 299 008, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7683705 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS Offset: 4 702 208, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7683819 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS Offset: 5 017 600, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:12,7683997 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Offset: 1 024, Length: 12 800, I/O Flags: Non-cached, Paging I/O 13:39:12,7684110 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Offset: 13 824, Length: 512, I/O Flags: Non-cached, Paging I/O 13:39:12,7684215 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Offset: 14 336, Length: 2 048, I/O Flags: Non-cached, Paging I/O 13:39:12,7684508 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Offset: 1 024, Length: 530 944, I/O Flags: Non-cached, Paging I/O 13:39:12,7684718 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Offset: 531 968, Length: 6 144, I/O Flags: Non-cached, Paging I/O 13:39:12,7684827 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Offset: 538 112, Length: 2 048, I/O Flags: Non-cached, Paging I/O 13:39:12,7684951 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Offset: 3 989 504, Length: 4 096, I/O Flags: Non-cached, Paging I/O 13:39:13,1859556 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0000000 seconds, Kernel Time: 0.0625000 seconds, Private Bytes: 73 728, Working Set: 90 112 13:39:13,3498184 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ntdll.dll SUCCESS 13:39:13,3499376 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\mscoree.dll SUCCESS 13:39:13,3501006 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\kernel32.dll SUCCESS 13:39:13,3501641 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS 13:39:13,3502742 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shimeng.dll SUCCESS 13:39:13,3503824 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3504903 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\user32.dll SUCCESS 13:39:13,3505989 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\gdi32.dll SUCCESS 13:39:13,3507088 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\advapi32.dll SUCCESS 13:39:13,3508173 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\rpcrt4.dll SUCCESS 13:39:13,3509247 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\winmm.dll SUCCESS 13:39:13,3510330 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\ole32.dll SUCCESS 13:39:13,3511525 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msvcrt.dll SUCCESS 13:39:13,3512582 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\oleaut32.dll SUCCESS 13:39:13,3513642 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msacm32.dll SUCCESS 13:39:13,3514718 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\version.dll SUCCESS 13:39:13,3515831 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shell32.dll SUCCESS 13:39:13,3516898 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shlwapi.dll SUCCESS 13:39:13,3517953 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\userenv.dll SUCCESS 13:39:13,3519019 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\uxtheme.dll SUCCESS 13:39:13,3520077 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:13,3521130 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\lpk.dll SUCCESS 13:39:13,3522181 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\usp10.dll SUCCESS 13:39:13,3523244 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\wbsys.dll SUCCESS 13:39:13,3524357 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS 13:39:13,3525427 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comctl32.dll SUCCESS 13:39:13,3526317 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS 13:39:13,3527551 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,3528718 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS 13:39:13,3530060 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS 13:39:13,3531246 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msctf.dll SUCCESS 13:39:13,3532349 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS 13:39:13,3533307 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS 13:39:13,3534416 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS 13:39:13,3535365 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS 13:39:13,3536758 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS 13:39:13,3538087 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS 13:39:13,3539302 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS 13:39:13,3540545 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,3541666 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\apphelp.dll SUCCESS 13:39:13,3542750 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\secur32.dll SUCCESS 13:39:13,3543857 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\clbcatq.dll SUCCESS 13:39:13,3545190 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comres.dll SUCCESS 13:39:13,3546362 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS 13:39:13,3547193 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS 13:39:13,3547838 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS 13:39:13,3549520 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS 13:39:13,3549948 SexyCity.exe 564 CloseFile C: SUCCESS 13:39:13,3550241 SexyCity.exe 564 CloseFile E: SUCCESS 13:39:13,3551163 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SexyCity.exe NAME NOT FOUND Desired Access: Read 13:39:13,3552991 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0 SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,3553327 SexyCity.exe 564 FileSystemControl C:\Program Files\Sexy City\2.0.0 SUCCESS Control: FSCTL_IS_VOLUME_MOUNTED 13:39:13,3554874 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll SUCCESS CreationTime: 18/03/2010 10:09:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 10:09:00, ChangeTime: 15/02/2011 22:19:50, AllocationSize: 299 008, EndOfFile: 297 808, FileAttributes: A 13:39:13,3556493 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\mscoree.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3557517 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\mscoree.dll SUCCESS AllocationSize: 299 008, EndOfFile: 297 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3558497 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\mscoree.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,3559558 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\mscoree.dll SUCCESS 13:39:13,3560888 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\mscoree.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,3561933 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\mscoree.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,3562008 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\mscoree.dll SUCCESS AllocationSize: 299 008, EndOfFile: 297 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3562128 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\mscoree.dll SUCCESS SyncType: SyncTypeOther 13:39:13,3563153 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\mscoree.dll SUCCESS 13:39:13,3564791 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll SUCCESS CreationTime: 18/03/2010 10:09:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 10:09:00, ChangeTime: 15/02/2011 22:19:50, AllocationSize: 299 008, EndOfFile: 297 808, FileAttributes: A 13:39:13,3566339 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\mscoree.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3567351 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\mscoree.dll SUCCESS AllocationSize: 299 008, EndOfFile: 297 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3568489 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\mscoree.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,3569550 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\mscoree.dll SUCCESS 13:39:13,3570879 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\mscoree.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,3571900 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\mscoree.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,3572156 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\mscoree.dll SUCCESS SyncType: SyncTypeOther 13:39:13,3572340 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\SafeBoot\Option NAME NOT FOUND Desired Access: Query Value, Set Value 13:39:13,3572708 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS Desired Access: Query Value 13:39:13,3573133 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,3573290 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS 13:39:13,3573437 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers NAME NOT FOUND Desired Access: Query Value 13:39:13,3574554 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\mscoree.dll SUCCESS 13:39:13,3812691 SexyCity.exe 564 Load Image C:\WINDOWS\system32\mscoree.dll SUCCESS Image Base: 0x79000000, Image Size: 0x4a000 13:39:13,3825456 SexyCity.exe 564 Load Image C:\WINDOWS\system32\kernel32.dll SUCCESS Image Base: 0x7c800000, Image Size: 0x105000 13:39:13,3828750 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Terminal Server SUCCESS Desired Access: Read 13:39:13,3829306 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,3829535 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Control\Terminal Server SUCCESS 13:39:13,3835220 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\ShimEng.dll NAME NOT FOUND 13:39:13,3836721 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\shimeng.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:12, AllocationSize: 65 536, EndOfFile: 65 536, FileAttributes: A 13:39:13,3838286 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shimeng.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3839339 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\shimeng.dll SUCCESS AllocationSize: 65 536, EndOfFile: 65 536, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3840327 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\shimeng.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,3841381 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shimeng.dll SUCCESS 13:39:13,3842870 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shimeng.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,3844013 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shimeng.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,3844299 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shimeng.dll SUCCESS SyncType: SyncTypeOther 13:39:13,3845341 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shimeng.dll SUCCESS 13:39:13,3857373 SexyCity.exe 564 Load Image C:\WINDOWS\system32\shimeng.dll SUCCESS Image Base: 0x5cea0000, Image Size: 0x26000 13:39:13,3861810 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3863183 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3864379 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,3865934 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 27/09/2010 09:40:22, LastWriteTime: 04/10/2006 15:06:21, ChangeTime: 25/03/2008 12:05:00, FileAttributes: A 13:39:13,3867260 SexyCity.exe 564 ReadFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Offset: 0, Length: 1 024 13:39:13,3868657 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:13,3870224 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3871310 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3872533 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,3872614 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3872748 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeOther 13:39:13,3874181 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3876243 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\systest.sdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,3878072 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\systest.sdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a 13:39:13,3884490 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3885833 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3886788 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,3887915 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3889224 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3890263 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3891684 SexyCity.exe 564 QueryOpen C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:29, AllocationSize: 1 855 488, EndOfFile: 1 852 416, FileAttributes: A 13:39:13,3893123 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3894116 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3895046 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,3896032 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3897781 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,3898782 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,3898852 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3898972 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeOther 13:39:13,3899965 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3901580 SexyCity.exe 564 QueryOpen C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:29, AllocationSize: 1 855 488, EndOfFile: 1 852 416, FileAttributes: A 13:39:13,3903007 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3904000 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3904938 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,3905923 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3907483 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,3908498 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,3908563 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3908680 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeOther 13:39:13,3909673 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3911201 SexyCity.exe 564 QueryOpen C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:29, AllocationSize: 1 855 488, EndOfFile: 1 852 416, FileAttributes: A 13:39:13,3912651 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,3913638 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS AllocationSize: 1 855 488, EndOfFile: 1 852 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,3914571 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,3915559 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3916958 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,3917954 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,3918300 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS SyncType: SyncTypeOther 13:39:13,3919305 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS 13:39:13,3932628 SexyCity.exe 564 Load Image C:\WINDOWS\AppPatch\AcGenral.dll SUCCESS Image Base: 0x595b0000, Image Size: 0x1ca000 13:39:13,3957603 SexyCity.exe 564 Load Image C:\WINDOWS\system32\user32.dll SUCCESS Image Base: 0x7e390000, Image Size: 0x90000 13:39:13,3981726 SexyCity.exe 564 Load Image C:\WINDOWS\system32\gdi32.dll SUCCESS Image Base: 0x77ef0000, Image Size: 0x47000 13:39:13,4001025 SexyCity.exe 564 Load Image C:\WINDOWS\system32\advapi32.dll SUCCESS Image Base: 0x77da0000, Image Size: 0xac000 13:39:13,4018850 SexyCity.exe 564 Load Image C:\WINDOWS\system32\rpcrt4.dll SUCCESS Image Base: 0x77e50000, Image Size: 0x91000 13:39:13,4021039 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\WINMM.dll NAME NOT FOUND 13:39:13,4022860 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\winmm.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:29, AllocationSize: 184 320, EndOfFile: 180 736, FileAttributes: A 13:39:13,4024847 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\winmm.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4026032 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\winmm.dll SUCCESS AllocationSize: 184 320, EndOfFile: 180 736, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4027125 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\winmm.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4028300 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\winmm.dll SUCCESS 13:39:13,4029811 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\winmm.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4030865 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\winmm.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4031237 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\winmm.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4032593 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\winmm.dll SUCCESS 13:39:13,4047294 SexyCity.exe 564 Load Image C:\WINDOWS\system32\winmm.dll SUCCESS Image Base: 0x76ae0000, Image Size: 0x2f000 13:39:13,4063074 SexyCity.exe 564 Load Image C:\WINDOWS\system32\ole32.dll SUCCESS Image Base: 0x774a0000, Image Size: 0x13d000 13:39:13,4077153 SexyCity.exe 564 Load Image C:\WINDOWS\system32\msvcrt.dll SUCCESS Image Base: 0x77be0000, Image Size: 0x58000 13:39:13,4095102 SexyCity.exe 564 Load Image C:\WINDOWS\system32\oleaut32.dll SUCCESS Image Base: 0x770e0000, Image Size: 0x8b000 13:39:13,4097151 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\MSACM32.dll NAME NOT FOUND 13:39:13,4098927 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\msacm32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:29, AllocationSize: 73 728, EndOfFile: 72 192, FileAttributes: A 13:39:13,4100691 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msacm32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4101832 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msacm32.dll SUCCESS AllocationSize: 73 728, EndOfFile: 72 192, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4102926 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msacm32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4104158 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msacm32.dll SUCCESS 13:39:13,4105520 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msacm32.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4106548 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msacm32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4106807 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msacm32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4107853 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msacm32.dll SUCCESS 13:39:13,4122720 SexyCity.exe 564 Load Image C:\WINDOWS\system32\msacm32.dll SUCCESS Image Base: 0x77bb0000, Image Size: 0x15000 13:39:13,4139489 SexyCity.exe 564 Load Image C:\WINDOWS\system32\version.dll SUCCESS Image Base: 0x77bd0000, Image Size: 0x8000 13:39:13,4153891 SexyCity.exe 564 Load Image C:\WINDOWS\system32\shell32.dll SUCCESS Image Base: 0x7c9d0000, Image Size: 0xc5a000 13:39:13,4172071 SexyCity.exe 564 Load Image C:\WINDOWS\system32\shlwapi.dll SUCCESS Image Base: 0x77f40000, Image Size: 0x7c000 13:39:13,4189263 SexyCity.exe 564 Load Image C:\WINDOWS\system32\userenv.dll SUCCESS Image Base: 0x76960000, Image Size: 0xb5000 13:39:13,4192504 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\UxTheme.dll NAME NOT FOUND 13:39:13,4194006 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\uxtheme.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/01/2003 14:42:13, ChangeTime: 03/05/2009 08:32:32, AllocationSize: 204 800, EndOfFile: 204 288, FileAttributes: A 13:39:13,4195496 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\uxtheme.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4196684 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\uxtheme.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4196968 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\uxtheme.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4199482 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\uxtheme.dll SUCCESS 13:39:13,4213870 SexyCity.exe 564 Load Image C:\WINDOWS\system32\uxtheme.dll SUCCESS Image Base: 0x5b090000, Image Size: 0x34000 13:39:13,4217428 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShimEng.dll NAME NOT FOUND Desired Access: Read 13:39:13,4217672 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4217821 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4218576 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager SUCCESS Desired Access: Query Value 13:39:13,4218995 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode NAME NOT FOUND Length: 16 13:39:13,4219288 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager SUCCESS 13:39:13,4221025 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\imm32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:03, AllocationSize: 110 592, EndOfFile: 110 080, FileAttributes: A 13:39:13,4222617 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4223683 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\imm32.dll SUCCESS AllocationSize: 110 592, EndOfFile: 110 080, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4225302 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\imm32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4226364 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:13,4229472 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4230712 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4230795 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\imm32.dll SUCCESS AllocationSize: 110 592, EndOfFile: 110 080, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4230926 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4232097 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:13,4234378 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\imm32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:03, AllocationSize: 110 592, EndOfFile: 110 080, FileAttributes: A 13:39:13,4236142 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4237313 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\imm32.dll SUCCESS AllocationSize: 110 592, EndOfFile: 110 080, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4238356 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\imm32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4240577 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:13,4241962 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4243616 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4243687 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\imm32.dll SUCCESS AllocationSize: 110 592, EndOfFile: 110 080, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4243804 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4244856 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:13,4246467 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\imm32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:03, AllocationSize: 110 592, EndOfFile: 110 080, FileAttributes: A 13:39:13,4248020 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4249048 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\imm32.dll SUCCESS AllocationSize: 110 592, EndOfFile: 110 080, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4250019 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\imm32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4251056 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:13,4252429 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\imm32.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4253740 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4253991 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\imm32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4255042 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\imm32.dll SUCCESS 13:39:13,4283676 SexyCity.exe 564 Load Image C:\WINDOWS\system32\imm32.dll SUCCESS Image Base: 0x76320000, Image Size: 0x1d000 13:39:13,4284812 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL NAME NOT FOUND Desired Access: Read 13:39:13,4286862 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\imm32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:03, AllocationSize: 110 592, EndOfFile: 110 080, FileAttributes: A 13:39:13,4287254 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll NAME NOT FOUND Desired Access: Read 13:39:13,4287422 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KERNEL32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4287613 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoree.dll SUCCESS Desired Access: Read 13:39:13,4288195 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoree.dll\CheckAppHelp SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,4288390 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoree.dll SUCCESS 13:39:13,4288543 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility SUCCESS Desired Access: Query Value 13:39:13,4289009 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility\DisableAppCompat NAME NOT FOUND Length: 20 13:39:13,4289148 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility SUCCESS 13:39:13,4370988 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll NAME NOT FOUND Desired Access: Read 13:39:13,4371154 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4371269 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINMM.dll NAME NOT FOUND Desired Access: Read 13:39:13,4371384 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll NAME NOT FOUND Desired Access: Read 13:39:13,4371487 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4371640 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4371784 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSACM32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4371899 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll NAME NOT FOUND Desired Access: Read 13:39:13,4372002 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll NAME NOT FOUND Desired Access: Read 13:39:13,4372109 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4372237 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll NAME NOT FOUND Desired Access: Read 13:39:13,4372345 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UxTheme.dll NAME NOT FOUND Desired Access: Read 13:39:13,4372444 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcGenral.DLL NAME NOT FOUND Desired Access: Read 13:39:13,4374039 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\imm32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:03, AllocationSize: 110 592, EndOfFile: 110 080, FileAttributes: A 13:39:13,4374197 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Error Message Instrument NAME NOT FOUND Desired Access: Read 13:39:13,4374479 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize SUCCESS Desired Access: Read 13:39:13,4374851 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles NAME NOT FOUND Length: 20 13:39:13,4375064 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize SUCCESS 13:39:13,4376462 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32 SUCCESS Desired Access: Read 13:39:13,4376769 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32\SexyCity NAME NOT FOUND Length: 172 13:39:13,4376922 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32 SUCCESS 13:39:13,4376989 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility SUCCESS Desired Access: Read 13:39:13,4377249 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IME Compatibility\SexyCity NAME NOT FOUND Length: 172 13:39:13,4377368 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IME Compatibility SUCCESS 13:39:13,4378662 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\LPK.DLL NAME NOT FOUND 13:39:13,4381617 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\lpk.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:03, AllocationSize: 24 576, EndOfFile: 22 016, FileAttributes: A 13:39:13,4383214 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\lpk.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4384493 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\lpk.dll SUCCESS AllocationSize: 24 576, EndOfFile: 22 016, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4385704 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\lpk.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4389625 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\lpk.dll SUCCESS 13:39:13,4391274 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\lpk.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4392534 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\lpk.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4392802 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\lpk.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4395150 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\lpk.dll SUCCESS 13:39:13,4421791 SexyCity.exe 564 Load Image C:\WINDOWS\system32\lpk.dll SUCCESS Image Base: 0x62dc0000, Image Size: 0x9000 13:39:13,4423459 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\USP10.dll NAME NOT FOUND 13:39:13,4424989 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\usp10.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:03, AllocationSize: 409 600, EndOfFile: 406 528, FileAttributes: A 13:39:13,4426527 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\usp10.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4428002 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\usp10.dll SUCCESS AllocationSize: 409 600, EndOfFile: 406 528, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4429012 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\usp10.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4430084 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\usp10.dll SUCCESS 13:39:13,4431461 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\usp10.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4432532 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\usp10.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4432802 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\usp10.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4433879 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\usp10.dll SUCCESS 13:39:13,4460116 SexyCity.exe 564 Load Image C:\WINDOWS\system32\usp10.dll SUCCESS Image Base: 0x753c0000, Image Size: 0x6b000 13:39:13,4461279 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USP10.dll NAME NOT FOUND Desired Access: Read 13:39:13,4463371 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LPK.DLL NAME NOT FOUND Desired Access: Read 13:39:13,4464332 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows SUCCESS Desired Access: Read 13:39:13,4464646 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SUCCESS Type: REG_SZ, Length: 20, Data: wbsys.dll 13:39:13,4465748 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\wbsys.dll NAME NOT FOUND 13:39:13,4468912 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\wbsys.dll SUCCESS CreationTime: 08/03/2008 10:43:32, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/05/2007 12:34:34, ChangeTime: 08/03/2008 10:43:32, AllocationSize: 45 056, EndOfFile: 42 672, FileAttributes: A 13:39:13,4471586 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\wbsys.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4472828 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\wbsys.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4473296 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\wbsys.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4474705 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\wbsys.dll SUCCESS 13:39:13,4496254 SexyCity.exe 564 Load Image C:\WINDOWS\system32\wbsys.dll SUCCESS Image Base: 0x66500000, Image Size: 0xa000 13:39:13,4497039 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbsys.dll NAME NOT FOUND Desired Access: Read 13:39:13,4500109 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows SUCCESS 13:39:13,4505748 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS Desired Access: Read 13:39:13,4506084 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LeakTrack NAME NOT FOUND Length: 144 13:39:13,4506368 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS 13:39:13,4506454 SexyCity.exe 564 RegOpenKey HKLM SUCCESS Desired Access: Maximum Allowed 13:39:13,4506845 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics NAME NOT FOUND Desired Access: Read 13:39:13,4507201 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32 SUCCESS Desired Access: Read 13:39:13,4507505 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave SUCCESS Type: REG_SZ, Length: 22, Data: wdmaud.drv 13:39:13,4507827 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave SUCCESS Type: REG_SZ, Length: 22, Data: wdmaud.drv 13:39:13,4507924 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave1 NAME NOT FOUND Length: 536 13:39:13,4508020 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave2 NAME NOT FOUND Length: 536 13:39:13,4508100 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave3 NAME NOT FOUND Length: 536 13:39:13,4508179 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave4 NAME NOT FOUND Length: 536 13:39:13,4508270 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave5 NAME NOT FOUND Length: 536 13:39:13,4508350 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave6 NAME NOT FOUND Length: 536 13:39:13,4508430 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave7 NAME NOT FOUND Length: 536 13:39:13,4508510 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave8 NAME NOT FOUND Length: 536 13:39:13,4508593 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave9 NAME NOT FOUND Length: 536 13:39:13,4508679 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi SUCCESS Type: REG_SZ, Length: 22, Data: wdmaud.drv 13:39:13,4508810 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi SUCCESS Type: REG_SZ, Length: 22, Data: wdmaud.drv 13:39:13,4508904 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi1 NAME NOT FOUND Length: 536 13:39:13,4508991 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi2 NAME NOT FOUND Length: 536 13:39:13,4509075 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi3 NAME NOT FOUND Length: 536 13:39:13,4509159 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi4 NAME NOT FOUND Length: 536 13:39:13,4509241 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi5 NAME NOT FOUND Length: 536 13:39:13,4509326 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi6 NAME NOT FOUND Length: 536 13:39:13,4509411 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi7 NAME NOT FOUND Length: 536 13:39:13,4509493 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi8 NAME NOT FOUND Length: 536 13:39:13,4509579 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi9 NAME NOT FOUND Length: 536 13:39:13,4509674 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux SUCCESS Type: REG_SZ, Length: 22, Data: wdmaud.drv 13:39:13,4509766 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux SUCCESS Type: REG_SZ, Length: 22, Data: wdmaud.drv 13:39:13,4509854 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux1 NAME NOT FOUND Length: 536 13:39:13,4509936 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux2 NAME NOT FOUND Length: 536 13:39:13,4510015 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux3 NAME NOT FOUND Length: 536 13:39:13,4510094 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux4 NAME NOT FOUND Length: 536 13:39:13,4510173 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux5 NAME NOT FOUND Length: 536 13:39:13,4510252 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux6 NAME NOT FOUND Length: 536 13:39:13,4510333 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux7 NAME NOT FOUND Length: 536 13:39:13,4510413 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux8 NAME NOT FOUND Length: 536 13:39:13,4510494 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux9 NAME NOT FOUND Length: 536 13:39:13,4510580 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm SUCCESS Desired Access: All Access 13:39:13,4511078 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,4511221 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm SUCCESS 13:39:13,4511441 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer SUCCESS Type: REG_SZ, Length: 22, Data: wdmaud.drv 13:39:13,4511545 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer SUCCESS Type: REG_SZ, Length: 22, Data: wdmaud.drv 13:39:13,4511637 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer1 NAME NOT FOUND Length: 536 13:39:13,4511725 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer2 NAME NOT FOUND Length: 536 13:39:13,4511812 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer3 NAME NOT FOUND Length: 536 13:39:13,4511898 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer4 NAME NOT FOUND Length: 536 13:39:13,4511996 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer5 NAME NOT FOUND Length: 536 13:39:13,4512080 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer6 NAME NOT FOUND Length: 536 13:39:13,4512164 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer7 NAME NOT FOUND Length: 536 13:39:13,4512247 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer8 NAME NOT FOUND Length: 536 13:39:13,4512329 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer9 NAME NOT FOUND Length: 536 13:39:13,4515514 SexyCity.exe 564 RegCreateKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS Desired Access: Set Value 13:39:13,4515858 SexyCity.exe 564 RegSetValue HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed SUCCESS Type: REG_BINARY, Length: 80, Data: 94 3B AD 67 3F 28 F1 03 6E 52 E9 85 46 F8 F9 D3 13:39:13,4517720 SexyCity.exe 564 SetEndOfFileInformationFile C:\WINDOWS\system32\config\software.LOG SUCCESS EndOfFile: 16 384 13:39:13,4520920 SexyCity.exe 564 SetEndOfFileInformationFile C:\WINDOWS\system32\config\software.LOG SUCCESS EndOfFile: 16 384 13:39:13,4522073 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS 13:39:13,4522351 SexyCity.exe 564 RegOpenKey HKLM\SYSTEM\CurrentControlSet\Control\Session Manager SUCCESS Desired Access: Read 13:39:13,4522700 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\CriticalSectionTimeout SUCCESS Type: REG_DWORD, Length: 4, Data: 2592000 13:39:13,4522845 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager SUCCESS 13:39:13,4522914 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Ole SUCCESS Desired Access: Read 13:39:13,4523168 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Ole\RWLockResourceTimeOut NAME NOT FOUND Length: 144 13:39:13,4523284 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Ole SUCCESS 13:39:13,4523421 SexyCity.exe 564 RegOpenKey HKCR\Interface SUCCESS Desired Access: Read 13:39:13,4523788 SexyCity.exe 564 RegCloseKey HKCR\Interface SUCCESS 13:39:13,4523838 SexyCity.exe 564 RegOpenKey HKCR\Interface\{00020400-0000-0000-C000-000000000046} SUCCESS Desired Access: Read 13:39:13,4524172 SexyCity.exe 564 RegCloseKey HKCR\Interface\{00020400-0000-0000-C000-000000000046} SUCCESS 13:39:13,4524483 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\OLEAUT NAME NOT FOUND Desired Access: Query Value 13:39:13,4524728 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\OLEAUT\UserEra NAME NOT FOUND Desired Access: Query Value, Enumerate Sub Keys 13:39:13,4524843 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\OLEAUT NAME NOT FOUND Desired Access: Query Value 13:39:13,4525060 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,4525305 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Multimedia\Audio SUCCESS Desired Access: Write, Query Value 13:39:13,4525748 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Multimedia\Audio\SystemFormats SUCCESS Type: REG_SZ, Length: 92, Data: Qualité CD,Qualité radio,Qualité téléphonique 13:39:13,4527089 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Multimedia\Audio SUCCESS 13:39:13,4527230 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4527506 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Desired Access: Read 13:39:13,4527832 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 0, Type: REG_SZ 13:39:13,4527925 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 1, Type: REG_SZ 13:39:13,4527995 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 2, Type: REG_SZ 13:39:13,4528063 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 3, Type: REG_SZ 13:39:13,4528159 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 4, Type: REG_SZ 13:39:13,4528230 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 5, Type: REG_SZ 13:39:13,4528299 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 6, Type: REG_SZ 13:39:13,4528368 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 7, Type: REG_SZ 13:39:13,4528440 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 8, Type: REG_SZ 13:39:13,4528507 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 9, Type: REG_SZ 13:39:13,4528576 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 10, Type: REG_SZ 13:39:13,4528643 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 11, Type: REG_SZ 13:39:13,4528712 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 12, Type: REG_SZ 13:39:13,4528779 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 13, Type: REG_SZ 13:39:13,4528845 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 14, Type: REG_SZ 13:39:13,4528913 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 15, Type: REG_SZ 13:39:13,4528980 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 16, Type: REG_SZ 13:39:13,4529046 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 17, Type: REG_SZ 13:39:13,4529113 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 18, Type: REG_SZ 13:39:13,4529183 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS Index: 19, Type: REG_SZ 13:39:13,4529247 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 NO MORE ENTRIES Index: 20, Length: 512 13:39:13,4529351 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS 13:39:13,4529544 SexyCity.exe 564 RegQueryKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 BUFFER OVERFLOW Query: Basic, Length: 24 13:39:13,4529635 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.vorbis BUFFER OVERFLOW Length: 16 13:39:13,4529713 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.vorbis SUCCESS Type: REG_SZ, Length: 22, Data: vorbis.acm 13:39:13,4529822 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS 13:39:13,4529899 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\AudioCompressionManager\DriverCache SUCCESS Desired Access: Maximum Allowed 13:39:13,4530174 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.vorbis SUCCESS Desired Access: Maximum Allowed 13:39:13,4530433 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.vorbis\fdwSupport SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,4530518 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.vorbis\cFormatTags SUCCESS Type: REG_DWORD, Length: 4, Data: 7 13:39:13,4530596 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.vorbis\aFormatTagCache SUCCESS Type: REG_BINARY, Length: 56, Data: 01 00 00 00 10 00 00 00 4F 67 00 00 1A 00 00 00 13:39:13,4530677 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.vorbis\cFilterTags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,4530790 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.vorbis SUCCESS 13:39:13,4530901 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache SUCCESS 13:39:13,4531007 SexyCity.exe 564 RegQueryKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 BUFFER OVERFLOW Query: Basic, Length: 24 13:39:13,4531093 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.ac3acm BUFFER OVERFLOW Length: 16 13:39:13,4531178 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.ac3acm SUCCESS Type: REG_SZ, Length: 22, Data: ac3acm.acm 13:39:13,4531423 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS 13:39:13,4531505 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\AudioCompressionManager\DriverCache SUCCESS Desired Access: Maximum Allowed 13:39:13,4531829 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.ac3acm SUCCESS Desired Access: Maximum Allowed 13:39:13,4532075 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.ac3acm\fdwSupport SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,4532156 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.ac3acm\cFormatTags SUCCESS Type: REG_DWORD, Length: 4, Data: 2 13:39:13,4532236 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.ac3acm\aFormatTagCache SUCCESS Type: REG_BINARY, Length: 16, Data: 01 00 00 00 10 00 00 00 00 20 00 00 12 00 00 00 13:39:13,4532313 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.ac3acm\cFilterTags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,4532429 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.ac3acm SUCCESS 13:39:13,4532537 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache SUCCESS 13:39:13,4532631 SexyCity.exe 564 RegQueryKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 BUFFER OVERFLOW Query: Basic, Length: 24 13:39:13,4532717 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.lameacm BUFFER OVERFLOW Length: 16 13:39:13,4532805 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.lameacm SUCCESS Type: REG_SZ, Length: 24, Data: lameACM.acm 13:39:13,4532923 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS 13:39:13,4532992 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\AudioCompressionManager\DriverCache SUCCESS Desired Access: Maximum Allowed 13:39:13,4533230 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.lameacm SUCCESS Desired Access: Maximum Allowed 13:39:13,4533471 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.lameacm\fdwSupport SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,4533555 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.lameacm\cFormatTags SUCCESS Type: REG_DWORD, Length: 4, Data: 2 13:39:13,4533633 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.lameacm\aFormatTagCache SUCCESS Type: REG_BINARY, Length: 16, Data: 55 00 00 00 1E 00 00 00 01 00 00 00 10 00 00 00 13:39:13,4533710 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.lameacm\cFilterTags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,4533825 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.lameacm SUCCESS 13:39:13,4533932 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache SUCCESS 13:39:13,4534064 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,4534292 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Multimedia\Audio Compression Manager SUCCESS Desired Access: Write 13:39:13,4535178 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4536138 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM SUCCESS Desired Access: Read/Write 13:39:13,4536454 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Multimedia\Audio Compression Manager SUCCESS 13:39:13,4536560 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM\NoPCMConverter NAME NOT FOUND Length: 144 13:39:13,4536698 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM SUCCESS 13:39:13,4537046 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,4537285 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,4537405 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,4537620 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,4537777 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,4537873 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4538110 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,4538339 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Multimedia\Audio Compression Manager SUCCESS Desired Access: Write 13:39:13,4538608 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4538701 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 SUCCESS Desired Access: Read/Write 13:39:13,4539163 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Multimedia\Audio Compression Manager SUCCESS 13:39:13,4539326 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00\Priority1 NAME NOT FOUND Length: 144 13:39:13,4539462 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 SUCCESS 13:39:13,4539546 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\MediaResources\acm SUCCESS Desired Access: Query Value, Enumerate Sub Keys 13:39:13,4539933 SexyCity.exe 564 RegEnumKey HKLM\System\CurrentControlSet\Control\MediaResources\acm NO MORE ENTRIES Index: 0, Length: 288 13:39:13,4540052 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Control\MediaResources\acm SUCCESS 13:39:13,4540262 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Performance NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,4541375 SexyCity.exe 564 RegOpenKey HKLM\SYSTEM\Setup SUCCESS Desired Access: Query Value 13:39:13,4541699 SexyCity.exe 564 RegQueryValue HKLM\SYSTEM\Setup\SystemSetupInProgress SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,4541825 SexyCity.exe 564 RegCloseKey HKLM\SYSTEM\Setup SUCCESS 13:39:13,4542053 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,4542290 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,4542386 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,4542567 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,4542690 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,4542780 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4544852 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\shell32.dll SUCCESS Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4546160 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shell32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,4546242 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\shell32.dll SUCCESS AllocationSize: 12 931 072, EndOfFile: 12 930 560, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4546381 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\shell32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4548013 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\SHELL32.dll.124.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4549506 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\SHELL32.dll.124.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4551052 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\SHELL32.dll.124.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4552135 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\SHELL32.dll.124.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4675214 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\shell32.dll SUCCESS 13:39:13,4675910 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots NAME NOT FOUND Desired Access: Enumerate Sub Keys 13:39:13,4676587 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe.Local NAME NOT FOUND 13:39:13,4677811 SexyCity.exe 564 QueryOpen C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03 SUCCESS CreationTime: 09/06/2007 10:36:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 09/06/2007 10:36:00, ChangeTime: 08/09/2007 16:02:14, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,4678992 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03 SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,4680708 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4681791 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS AllocationSize: 1 056 768, EndOfFile: 1 054 208, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4684648 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4685764 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS 13:39:13,4696154 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4697306 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4697397 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS AllocationSize: 1 056 768, EndOfFile: 1 054 208, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4697536 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4698626 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS 13:39:13,4701318 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4702409 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS AllocationSize: 1 056 768, EndOfFile: 1 054 208, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4703435 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4704484 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS 13:39:13,4706179 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4707258 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4707573 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4708666 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS 13:39:13,4724928 SexyCity.exe 564 Load Image C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll SUCCESS Image Base: 0x77390000, Image Size: 0x103000 13:39:13,4727058 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4727565 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,4730009 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,4730155 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,4730388 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,4730582 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,4730680 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4731846 SexyCity.exe 564 QueryOpen C:\WINDOWS\WindowsShell.Manifest SUCCESS CreationTime: 28/01/2008 19:23:11, LastAccessTime: 17/02/2011 13:38:43, LastWriteTime: 24/11/2004 21:03:04, ChangeTime: 15/02/2011 20:22:27, AllocationSize: 4 096, EndOfFile: 749, FileAttributes: RHA 13:39:13,4733090 SexyCity.exe 564 CreateFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4734253 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4735458 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WindowsShell.Manifest SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4735967 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS CreationTime: 28/01/2008 19:23:11, LastAccessTime: 17/02/2011 13:38:43, LastWriteTime: 24/11/2004 21:03:04, ChangeTime: 15/02/2011 20:22:27, FileAttributes: RHA 13:39:13,4736465 SexyCity.exe 564 ReadFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Offset: 0, Length: 749 13:39:13,4739379 SexyCity.exe 564 CloseFile C:\WINDOWS\WindowsShell.Manifest SUCCESS 13:39:13,4740423 SexyCity.exe 564 CreateFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4740959 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WindowsShell.Manifest SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4741041 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4741166 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WindowsShell.Manifest SUCCESS SyncType: SyncTypeOther 13:39:13,4742329 SexyCity.exe 564 CloseFile C:\WINDOWS\WindowsShell.Manifest SUCCESS 13:39:13,4743499 SexyCity.exe 564 QueryOpen C:\WINDOWS\WindowsShell.Manifest SUCCESS CreationTime: 28/01/2008 19:23:11, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 24/11/2004 21:03:04, ChangeTime: 15/02/2011 20:22:27, AllocationSize: 4 096, EndOfFile: 749, FileAttributes: RHA 13:39:13,4744543 SexyCity.exe 564 CreateFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4745864 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4746309 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WindowsShell.Manifest SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4746836 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS CreationTime: 28/01/2008 19:23:11, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 24/11/2004 21:03:04, ChangeTime: 15/02/2011 20:22:27, FileAttributes: RHA 13:39:13,4747302 SexyCity.exe 564 ReadFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Offset: 0, Length: 749 13:39:13,4747826 SexyCity.exe 564 CloseFile C:\WINDOWS\WindowsShell.Manifest SUCCESS 13:39:13,4748800 SexyCity.exe 564 CreateFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4749289 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WindowsShell.Manifest SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,4749361 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4749480 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WindowsShell.Manifest SUCCESS SyncType: SyncTypeOther 13:39:13,4749965 SexyCity.exe 564 CloseFile C:\WINDOWS\WindowsShell.Manifest SUCCESS 13:39:13,4751143 SexyCity.exe 564 CreateFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4751607 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4752027 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WindowsShell.Manifest SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4752467 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS CreationTime: 28/01/2008 19:23:11, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 24/11/2004 21:03:04, ChangeTime: 15/02/2011 20:22:27, FileAttributes: RHA 13:39:13,4752918 SexyCity.exe 564 ReadFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Offset: 0, Length: 749 13:39:13,4753434 SexyCity.exe 564 CloseFile C:\WINDOWS\WindowsShell.Manifest SUCCESS 13:39:13,4754227 SexyCity.exe 564 CreateFile C:\WINDOWS\WindowsShell.Manifest SUCCESS Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4754990 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WindowsShell.Manifest SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,4755061 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4755180 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WindowsShell.Manifest SUCCESS SyncType: SyncTypeOther 13:39:13,4755710 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WindowsShell.Manifest SUCCESS AllocationSize: 4 096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4756848 SexyCity.exe 564 CreateFile C:\WINDOWS\WindowsShell.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4757690 SexyCity.exe 564 CreateFile C:\WINDOWS\WindowsShell.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4863604 SexyCity.exe 564 CloseFile C:\WINDOWS\WindowsShell.Manifest SUCCESS 13:39:13,4868451 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Read 13:39:13,4869016 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,4869248 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\SmoothScroll NAME NOT FOUND Length: 144 13:39:13,4869481 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,4869717 SexyCity.exe 564 RegOpenKey HKCU\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced SUCCESS Desired Access: Read 13:39:13,4870072 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips NAME NOT FOUND Length: 144 13:39:13,4870264 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced SUCCESS 13:39:13,4870394 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4870596 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\LanguagePack SUCCESS Desired Access: Query Value 13:39:13,4870932 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack SUCCESS Index: 0, Name: THAI, Type: REG_DWORD, Length: 4, Data: 1 13:39:13,4871061 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack SUCCESS Index: 1, Name: HEBREW, Type: REG_DWORD, Length: 4, Data: 0 13:39:13,4871137 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack SUCCESS Index: 2, Name: ARABIC, Type: REG_DWORD, Length: 4, Data: 0 13:39:13,4871209 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack SUCCESS Index: 3, Name: VIETNAMESE, Type: REG_DWORD, Length: 4, Data: 3 13:39:13,4871286 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack SUCCESS Index: 4, Name: INDIAN, Type: REG_DWORD, Length: 4, Data: 4 13:39:13,4871357 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack SUCCESS Index: 5, Name: SURROGATE, Type: REG_DWORD, Length: 4, Data: 2 13:39:13,4871432 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack NO MORE ENTRIES Index: 6, Length: 220 13:39:13,4871658 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack SUCCESS 13:39:13,4894120 SexyCity.exe 564 Load Image C:\WINDOWS\system32\comctl32.dll SUCCESS Image Base: 0x58b50000, Image Size: 0x9a000 13:39:13,4896044 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll NAME NOT FOUND Desired Access: Read 13:39:13,4897394 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,4897762 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,4897875 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,4898077 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,4898233 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,4898360 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4900213 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4901487 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comctl32.dll SUCCESS AllocationSize: 618 496, EndOfFile: 617 472, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4902488 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\comctl32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4903635 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comctl32.dll SUCCESS 13:39:13,4905005 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll SUCCESS Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4906102 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comctl32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,4906177 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comctl32.dll SUCCESS AllocationSize: 618 496, EndOfFile: 617 472, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4906301 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comctl32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4907603 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll.124.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4908700 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll.124.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4910117 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll.124.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4911188 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comctl32.dll.124.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,4920724 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comctl32.dll SUCCESS 13:39:13,4921540 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Read 13:39:13,4921916 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,4922106 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\SmoothScroll NAME NOT FOUND Length: 144 13:39:13,4922379 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,4923810 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4926335 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS Desired Access: Maximum Allowed 13:39:13,4926714 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserEnvDebugLevel NAME NOT FOUND Length: 144 13:39:13,4926921 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS 13:39:13,4927021 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS Desired Access: Maximum Allowed 13:39:13,4927278 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ChkAccDebugLevel NAME NOT FOUND Length: 144 13:39:13,4927408 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS 13:39:13,4927529 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\ProductOptions SUCCESS Desired Access: Read 13:39:13,4927910 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\ProductOptions\ProductType SUCCESS Type: REG_SZ, Length: 12, Data: WinNT 13:39:13,4928037 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Control\ProductOptions SUCCESS 13:39:13,4928602 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Read 13:39:13,4928816 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS Desired Access: Read 13:39:13,4929143 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal SUCCESS Type: REG_EXPAND_SZ, Length: 56, Data: %USERPROFILE%\Mes documents 13:39:13,4929281 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local Settings SUCCESS Type: REG_EXPAND_SZ, Length: 58, Data: %USERPROFILE%\Local Settings 13:39:13,4929495 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS 13:39:13,4929596 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4929738 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS Desired Access: Maximum Allowed 13:39:13,4929996 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\RsopDebugLevel NAME NOT FOUND Length: 144 13:39:13,4930124 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS 13:39:13,4930236 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS Desired Access: Maximum Allowed 13:39:13,4930488 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserEnvDebugLevel NAME NOT FOUND Length: 144 13:39:13,4930577 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\RsopLogging NAME NOT FOUND Length: 144 13:39:13,4930693 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS 13:39:13,4930752 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\System NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,4930900 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS Desired Access: Maximum Allowed 13:39:13,4931134 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserEnvDebugLevel NAME NOT FOUND Length: 144 13:39:13,4931257 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS 13:39:13,4931335 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\System NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,4932757 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Read/Write 13:39:13,4933016 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager SUCCESS Desired Access: Query Value 13:39:13,4933399 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager\Compositing NAME NOT FOUND Length: 144 13:39:13,4933633 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager SUCCESS 13:39:13,4933752 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4933936 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Read 13:39:13,4934132 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Query Value 13:39:13,4934311 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\LameButtonText NAME NOT FOUND Length: 144 13:39:13,4934445 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,4934540 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,4942956 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:13,4943925 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework\Policy SUCCESS Desired Access: Read 13:39:13,4946147 SexyCity.exe 564 RegQueryKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy SUCCESS Query: Cached, SubKeys: 6, Values: 0 13:39:13,4946241 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy SUCCESS Index: 5, Name: v4.0 13:39:13,4946400 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy SUCCESS Index: 4, Name: v2.0 13:39:13,4946484 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy SUCCESS Index: 3, Name: v1.1 13:39:13,4946555 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy SUCCESS Index: 2, Name: Upgrades 13:39:13,4946664 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy SUCCESS Index: 1, Name: standards 13:39:13,4946737 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy SUCCESS Index: 0, Name: AppPatch 13:39:13,4946847 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v4.0 SUCCESS Desired Access: Read 13:39:13,4947216 SexyCity.exe 564 RegQueryKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v4.0 SUCCESS Query: Cached, SubKeys: 0, Values: 1 13:39:13,4947316 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v4.0 SUCCESS Index: 0, Name: 30319, Type: REG_SZ, Length: 24, Data: 30319-30319 13:39:13,4947491 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v4.0 SUCCESS 13:39:13,4948694 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll.local NAME NOT FOUND 13:39:13,4949015 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,4949285 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot SUCCESS Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,4949403 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot SUCCESS Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,4949521 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,4950708 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,4951246 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Filter: mscoreei.dll, 1: mscoreei.dll 13:39:13,4952463 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS 13:39:13,4952778 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy SUCCESS 13:39:13,4952965 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,4953212 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot SUCCESS Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,4953295 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot SUCCESS Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,4953398 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,4954511 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,4955476 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Filter: mscoreei.dll, 1: mscoreei.dll 13:39:13,4956043 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS 13:39:13,4956319 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,4956564 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot SUCCESS Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,4956641 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot SUCCESS Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,4956750 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,4957959 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS CreationTime: 18/03/2010 13:16:28, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 13:16:28, ChangeTime: 16/02/2011 10:30:18, AllocationSize: 413 696, EndOfFile: 413 008, FileAttributes: A 13:39:13,4959243 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4960001 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS AllocationSize: 413 696, EndOfFile: 413 008, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4960698 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4961491 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS 13:39:13,4962581 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4963780 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4963855 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS AllocationSize: 413 696, EndOfFile: 413 008, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4963978 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4964750 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS 13:39:13,4966215 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS CreationTime: 18/03/2010 13:16:28, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 13:16:28, ChangeTime: 16/02/2011 10:30:18, AllocationSize: 413 696, EndOfFile: 413 008, FileAttributes: A 13:39:13,4967295 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS CreationTime: 18/03/2010 13:16:28, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 13:16:28, ChangeTime: 16/02/2011 10:30:18, AllocationSize: 413 696, EndOfFile: 413 008, FileAttributes: A 13:39:13,4968536 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,4969306 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS AllocationSize: 413 696, EndOfFile: 413 008, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,4970010 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,4970774 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS 13:39:13,4972646 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,4973434 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,4973704 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS SyncType: SyncTypeOther 13:39:13,4974501 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS 13:39:13,4995374 SexyCity.exe 564 Load Image C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Image Base: 0x603b0000, Image Size: 0x66000 13:39:13,4996637 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoreei.dll NAME NOT FOUND Desired Access: Read 13:39:13,4999247 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,4999638 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir NAME NOT FOUND Length: 144 13:39:13,4999801 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,5001511 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll.local NAME NOT FOUND 13:39:13,5001807 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,5002053 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot SUCCESS Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,5002147 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot SUCCESS Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,5002299 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,5003296 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,5003820 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework\* SUCCESS Filter: *, 1: . 13:39:13,5004651 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework SUCCESS 0: .., 1: NETFXSBS10.exe, 2: NETFXSBS10.hkf, 3: netfxsbs12.hkf, 4: sbscmp10.dll, 5: sbscmp20_mscorlib.dll, 6: sbscmp20_mscorwks.dll, 7: sbscmp20_perfcounter.dll, 8: sbs_diasymreader.dll, 9: sbs_iehost.dll, 10: sbs_microsoft.jscript.dll, 11: sbs_microsoft.vsa.vb.codedomprocessor.dll, 12: sbs_mscordbi.dll, 13: sbs_mscorrc.dll, 14: sbs_mscorsec.dll, 15: sbs_system.configuration.install.dll, 16: sbs_system.data.dll, 17: sbs_system.enterpriseservices.dll, 18: sbs_VsaVb7rt.dll, 19: sbs_wminet_utils.dll, 20: SharedReg12.dll, 21: v1.0.3705, 22: v1.1.4322, 23: v2.0.50727, 24: v3.0, 25: v3.5, 26: v4.0.30319 13:39:13,5007237 SexyCity.exe 564 ReadFile C:\$Directory SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:13,5158140 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\clr.dll NAME NOT FOUND Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a 13:39:13,5160517 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll NAME NOT FOUND Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a 13:39:13,5163321 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\clr.dll NAME NOT FOUND Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a 13:39:13,5166159 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll SUCCESS Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,5308597 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll SUCCESS 13:39:13,5310221 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\clr.dll NAME NOT FOUND Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a 13:39:13,5311540 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,5312395 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,5314016 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\clr.dll SUCCESS Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,5315158 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\clr.dll SUCCESS 13:39:13,5315808 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Microsoft.NET\Framework NO MORE FILES 13:39:13,5316338 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework SUCCESS 13:39:13,5317973 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,5318556 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a 13:39:13,5318844 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,5319403 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue NAME NOT FOUND Length: 144 13:39:13,5319596 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,5319729 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,5319958 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR NAME NOT FOUND Length: 144 13:39:13,5320063 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,5321266 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,5321797 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS AllocationSize: 2 101 248, EndOfFile: 2 097 664, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,5322266 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,5322345 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS AllocationSize: 2 101 248, EndOfFile: 2 097 664, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,5322471 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeOther 13:39:13,5323484 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS 13:39:13,5324644 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,5325216 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS AllocationSize: 2 101 248, EndOfFile: 2 097 664, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,5325624 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,5325695 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS AllocationSize: 2 101 248, EndOfFile: 2 097 664, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,5325806 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeOther 13:39:13,5326550 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS 13:39:13,5326985 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,5327366 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\.NETFramework\Policy\Standards NAME NOT FOUND Desired Access: Read 13:39:13,5327610 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework\Policy\Standards SUCCESS Desired Access: Read 13:39:13,5327915 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\standards\v2.0.50727 NAME NOT FOUND Desired Access: Read 13:39:13,5328175 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\standards SUCCESS 13:39:13,5328482 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion SUCCESS Desired Access: Read 13:39:13,5328924 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NoClientChecks NAME NOT FOUND Length: 144 13:39:13,5329043 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion SUCCESS 13:39:13,5330422 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,5331254 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,5333660 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS CreationTime: 15/02/2011 09:40:52, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:16:58, ChangeTime: 15/02/2011 20:25:41, AllocationSize: 5 816 320, EndOfFile: 5 815 296, FileAttributes: A 13:39:13,5334945 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,5335717 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS AllocationSize: 5 816 320, EndOfFile: 5 815 296, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,5336440 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,5337280 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,5338391 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,5339174 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,5339248 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS AllocationSize: 5 816 320, EndOfFile: 5 815 296, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,5339372 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeOther 13:39:13,5340158 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,5341763 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS CreationTime: 15/02/2011 09:40:52, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:16:58, ChangeTime: 15/02/2011 20:25:41, AllocationSize: 5 816 320, EndOfFile: 5 815 296, FileAttributes: A 13:39:13,5342969 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS CreationTime: 15/02/2011 09:40:52, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:16:58, ChangeTime: 15/02/2011 20:25:41, AllocationSize: 5 816 320, EndOfFile: 5 815 296, FileAttributes: A 13:39:13,5344241 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,5345020 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS AllocationSize: 5 816 320, EndOfFile: 5 815 296, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,5345728 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,5346512 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,5347617 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,5348963 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,5349284 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS SyncType: SyncTypeOther 13:39:13,5350085 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,5371220 SexyCity.exe 564 Load Image C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Image Base: 0x79e70000, Image Size: 0x590000 13:39:13,5371669 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,5372089 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,5372209 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,5372441 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,5372637 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,5374065 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,5375380 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,5376248 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,5377346 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll.2.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,5378177 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll.2.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,5971788 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots NAME NOT FOUND Desired Access: Enumerate Sub Keys 13:39:13,5972482 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe.Local NAME NOT FOUND 13:39:13,5973682 SexyCity.exe 564 QueryOpen C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS CreationTime: 21/05/2010 14:49:41, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 21/05/2010 14:49:41, ChangeTime: 21/05/2010 14:49:41, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,5974852 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,5976485 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,5977543 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS AllocationSize: 634 880, EndOfFile: 632 656, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,5978540 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,5979813 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS 13:39:13,5981342 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,5982406 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,5982690 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS SyncType: SyncTypeOther 13:39:13,5983735 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS 13:39:13,6004730 SexyCity.exe 564 Load Image C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS Image Base: 0x78130000, Image Size: 0x9b000 13:39:13,6008915 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCR80.dll NAME NOT FOUND Desired Access: Read 13:39:13,6014507 SexyCity.exe 564 QueryOpen C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll SUCCESS CreationTime: 12/07/2009 00:12:06, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/07/2009 00:12:06, ChangeTime: 21/05/2010 14:49:41, AllocationSize: 634 880, EndOfFile: 632 656, FileAttributes: A 13:39:13,6014877 SexyCity.exe 564 CreateFile C:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6015074 SexyCity.exe 564 QueryDirectory C:\WINDOWS SUCCESS Filter: WINDOWS, 1: WINDOWS 13:39:13,6015350 SexyCity.exe 564 CloseFile C:\ SUCCESS 13:39:13,6016404 SexyCity.exe 564 CreateFile C:\WINDOWS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6016888 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS SUCCESS Filter: WinSxS, 1: WinSxS 13:39:13,6017446 SexyCity.exe 564 CloseFile C:\WINDOWS SUCCESS 13:39:13,6019179 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6019960 SexyCity.exe 564 QueryDirectory C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll SUCCESS Filter: MSVCR80.dll, 1: msvcr80.dll 13:39:13,6020780 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS 13:39:13,6021141 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorwks.dll SUCCESS Desired Access: Read 13:39:13,6021643 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorwks.dll\CheckAppHelp SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,6021836 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorwks.dll SUCCESS 13:39:13,6255837 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\.NETFramework NAME NOT FOUND Desired Access: Read 13:39:13,6255979 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,6256295 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\GCStressStart NAME NOT FOUND Length: 144 13:39:13,6256433 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,6256555 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\.NETFramework NAME NOT FOUND Desired Access: Read 13:39:13,6256650 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,6256982 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\GCStressStartAtJit NAME NOT FOUND Length: 144 13:39:13,6257103 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,6257370 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\.NETFramework NAME NOT FOUND Desired Access: Read 13:39:13,6257492 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,6257715 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\GCStressStart NAME NOT FOUND Length: 144 13:39:13,6257821 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,6257936 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\.NETFramework NAME NOT FOUND Desired Access: Read 13:39:13,6258021 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,6258219 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\GCStressStartAtJit NAME NOT FOUND Length: 144 13:39:13,6258321 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,6259250 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\.NETFramework NAME NOT FOUND Desired Access: Read 13:39:13,6259363 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,6259752 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache NAME NOT FOUND Length: 144 13:39:13,6259935 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,6260016 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\.NETFramework NAME NOT FOUND Desired Access: Read 13:39:13,6260105 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,6260481 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS Index: 0, Name: InstallRoot, Type: REG_SZ, Length: 72, Data: C:\WINDOWS\Microsoft.NET\Framework\ 13:39:13,6260630 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\.NETFramework NO MORE ENTRIES Index: 1, Length: 220 13:39:13,6262758 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework\Policy\AppPatch SUCCESS Desired Access: Read 13:39:13,6264118 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS CreationTime: 23/09/2010 05:01:25, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 17/02/2011 10:25:41, ChangeTime: 17/02/2011 10:25:41, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,6264329 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\AppPatch\v4.0.30319.00000 SUCCESS Desired Access: Read 13:39:13,6264740 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\AppPatch SUCCESS 13:39:13,6264838 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\AppPatch\v4.0.30319.00000\mscorwks.dll NAME NOT FOUND Desired Access: Read 13:39:13,6265052 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\AppPatch\v4.0.30319.00000 SUCCESS 13:39:13,6267037 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6268011 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS AllocationSize: 28 672, EndOfFile: 25 605, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6268846 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,6269768 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS CreationTime: 23/09/2005 06:28:48, LastAccessTime: 17/02/2011 11:07:51, LastWriteTime: 16/02/2011 13:33:09, ChangeTime: 16/02/2011 13:33:09, FileAttributes: A 13:39:13,6270674 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 0, Length: 1 024 13:39:13,6272646 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS 13:39:13,6273758 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6275029 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 0, Length: 4 095 13:39:13,6276955 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 4 095, Length: 6 266 13:39:13,6278946 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 10 361, Length: 4 279 13:39:13,6280575 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 14 640, Length: 4 176 13:39:13,6282084 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 18 816, Length: 4 273 13:39:13,6283309 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS 13:39:13,6285134 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6285681 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a 13:39:13,6286548 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Fusion SUCCESS Desired Access: Read 13:39:13,6287765 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.localgac NAME NOT FOUND 13:39:13,6287995 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Fusion SUCCESS Desired Access: Read 13:39:13,6288267 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\CacheLocation NAME NOT FOUND Length: 144 13:39:13,6288395 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion SUCCESS 13:39:13,6288557 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Fusion SUCCESS Desired Access: Read 13:39:13,6288777 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB NAME NOT FOUND Length: 144 13:39:13,6288845 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\Fusion NAME NOT FOUND Desired Access: Read 13:39:13,6289067 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion SUCCESS 13:39:13,6289140 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\EnableLog NAME NOT FOUND Length: 144 13:39:13,6289201 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\LoggingLevel NAME NOT FOUND Length: 144 13:39:13,6289258 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\ForceLog NAME NOT FOUND Length: 144 13:39:13,6289315 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\LogFailures NAME NOT FOUND Length: 144 13:39:13,6289464 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\VersioningLog NAME NOT FOUND Length: 144 13:39:13,6289524 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\LogResourceBinds NAME NOT FOUND Length: 144 13:39:13,6289607 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat NAME NOT FOUND Length: 144 13:39:13,6289664 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\DisableMSIPeek NAME NOT FOUND Length: 144 13:39:13,6289720 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NoClientChecks NAME NOT FOUND Length: 144 13:39:13,6289815 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion SUCCESS 13:39:13,6295206 SexyCity.exe 564 Thread Create SUCCESS Thread ID: 2148 13:39:13,6298715 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets SUCCESS Desired Access: Read 13:39:13,6299325 SexyCity.exe 564 RegQueryKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets SUCCESS Query: Cached, SubKeys: 2, Values: 1 13:39:13,6299480 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets SUCCESS Index: 0, Name: Internet 13:39:13,6299580 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet SUCCESS Desired Access: Read 13:39:13,6299870 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet SUCCESS Index: 0, Name: MediaPermission 13:39:13,6299977 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet SUCCESS Index: 1, Name: WebBrowserPermission 13:39:13,6300075 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet NO MORE ENTRIES Index: 2, Length: 288 13:39:13,6300203 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet SUCCESS 13:39:13,6300305 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets SUCCESS Index: 1, Name: LocalIntranet 13:39:13,6300406 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet SUCCESS Desired Access: Read 13:39:13,6300699 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet SUCCESS Index: 0, Name: MediaPermission 13:39:13,6300785 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet SUCCESS Index: 1, Name: WebBrowserPermission 13:39:13,6300866 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet NO MORE ENTRIES Index: 2, Length: 288 13:39:13,6300983 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet SUCCESS 13:39:13,6301080 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets NO MORE ENTRIES Index: 2, Length: 288 13:39:13,6301182 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets SUCCESS 13:39:13,6302696 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6303765 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,6305169 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6306208 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,6307600 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6308631 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,6310044 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6311073 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,6311560 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1060284298-1078081533-725345543-1004 SUCCESS Desired Access: Read 13:39:13,6311959 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1060284298-1078081533-725345543-1004 SUCCESS 13:39:13,6312748 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS Desired Access: Maximum Allowed 13:39:13,6313133 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData SUCCESS Type: REG_EXPAND_SZ, Length: 62, Data: %USERPROFILE%\Application Data 13:39:13,6313368 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS 13:39:13,6314212 SexyCity.exe 564 QueryOpen C:\Documents and Settings\DAMIEN\Application Data SUCCESS CreationTime: 09/06/2007 09:50:31, LastAccessTime: 17/02/2011 13:39:12, LastWriteTime: 15/02/2011 20:31:46, ChangeTime: 15/02/2011 20:31:46, AllocationSize: 0, EndOfFile: 0, FileAttributes: RHD 13:39:13,6314409 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders SUCCESS Desired Access: Maximum Allowed 13:39:13,6314787 SexyCity.exe 564 RegSetValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData SUCCESS Type: REG_SZ, Length: 100, Data: C:\Documents and Settings\DAMIEN\Application Data 13:39:13,6314963 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders SUCCESS 13:39:13,6316189 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6316994 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,6318117 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6318628 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS AllocationSize: 4 096, EndOfFile: 2 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6319137 SexyCity.exe 564 FileSystemControl C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,6319622 SexyCity.exe 564 QueryBasicInformationFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS CreationTime: 21/07/2008 20:39:52, LastAccessTime: 17/02/2011 11:07:54, LastWriteTime: 08/12/2010 18:20:30, ChangeTime: 08/12/2010 18:20:30, FileAttributes: A 13:39:13,6320112 SexyCity.exe 564 ReadFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS Offset: 0, Length: 1 024 13:39:13,6321054 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS 13:39:13,6321808 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6322323 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS AllocationSize: 4 096, EndOfFile: 2 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6322783 SexyCity.exe 564 ReadFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS Offset: 0, Length: 48 13:39:13,6323255 SexyCity.exe 564 QueryBasicInformationFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS CreationTime: 21/07/2008 20:39:52, LastAccessTime: 17/02/2011 11:07:54, LastWriteTime: 08/12/2010 18:20:30, ChangeTime: 08/12/2010 18:20:30, FileAttributes: A 13:39:13,6323445 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy NAME NOT FOUND Desired Access: Read 13:39:13,6325172 SexyCity.exe 564 Thread Create SUCCESS Thread ID: 2448 13:39:13,6326678 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 SUCCESS Desired Access: Read 13:39:13,6327102 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex SUCCESS Type: REG_DWORD, Length: 4, Data: 843 13:39:13,6327264 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 SUCCESS Desired Access: Read 13:39:13,6327531 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex SUCCESS Type: REG_DWORD, Length: 4, Data: 843 13:39:13,6329338 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index34b.dat SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6329747 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index34b SUCCESS Desired Access: Read 13:39:13,6330222 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index34b\NIUsageMask SUCCESS Type: REG_BINARY, Length: 20, Data: EF FB F3 C1 03 CF 00 00 C1 00 00 00 40 BE FF 7E 13:39:13,6330363 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index34b\ILUsageMask SUCCESS Type: REG_BINARY, Length: 20, Data: FF FF FF FF F3 CB E5 11 00 81 00 00 04 B7 FF FF 13:39:13,6330507 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index34b SUCCESS 13:39:13,6330650 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 SUCCESS 13:39:13,6330788 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5 SUCCESS Desired Access: Read 13:39:13,6331276 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5 SUCCESS Index: 0, Name: 8 13:39:13,6331413 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5 NO MORE ENTRIES Index: 1, Length: 288 13:39:13,6331559 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5 SUCCESS 13:39:13,6331846 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8 SUCCESS Desired Access: Read 13:39:13,6332317 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\DisplayName SUCCESS Type: REG_SZ, Length: 70, Data: mscorlib,2.0.0.0,,b77a5c561934e089 13:39:13,6332567 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\ConfigMask SUCCESS Type: REG_DWORD, Length: 4, Data: 4361 13:39:13,6332687 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\ConfigString SUCCESS Type: REG_SZ, Length: 2, Data: 13:39:13,6332780 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\MVID SUCCESS Type: REG_BINARY, Length: 16, Data: 9A DB 89 FA 22 FD 5B 4C E4 33 B5 AC A7 FB 1B 07 13:39:13,6332935 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8 SUCCESS 13:39:13,6333111 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8 SUCCESS Desired Access: Read 13:39:13,6333362 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\EvalationData NAME NOT FOUND Length: 144 13:39:13,6333459 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,6333557 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\ILDependencies SUCCESS Type: REG_BINARY, Length: 20, Data: C5 E2 50 79 A4 A3 38 38 08 00 00 00 02 00 00 00 13:39:13,6333663 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\NIDependencies NAME NOT FOUND Length: 144 13:39:13,6333752 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\MissingDependencies NAME NOT FOUND Length: 144 13:39:13,6333877 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8 SUCCESS 13:39:13,6334008 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\3838a3a4\8 SUCCESS Desired Access: Read 13:39:13,6334450 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\3838a3a4\8\DisplayName SUCCESS Type: REG_SZ, Length: 70, Data: mscorlib,2.0.0.0,,b77a5c561934e089 13:39:13,6334669 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\3838a3a4\8\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 8198 13:39:13,6334814 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\3838a3a4\8\Modules BUFFER OVERFLOW Length: 144 13:39:13,6334908 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\3838a3a4\8\Modules SUCCESS Type: REG_SZ, Length: 288, Data: sortkey.nlp|sorttbls.nlp|big5.nlp|bopomofo.nlp|ksc.nlp|prc.nlp|prcp.nlp|xjis.nlp|normidna.nlp|normnfc.nlp|normnfd.nlp|normnfkc.nlp|normnfkd.nlp 13:39:13,6335120 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\3838a3a4\8\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: 95 53 1D 3A B9 C1 6C 41 AF 90 0D AC FB DF C1 92 13:39:13,6335228 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\3838a3a4\8\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: 8B 43 2C 4B CB 3B CA 01 13:39:13,6335381 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\3838a3a4\8 SUCCESS 13:39:13,6335634 SexyCity.exe 564 RegCreateKey HKLM\Software\Microsoft\Fusion\GACChangeNotification\Default SUCCESS Desired Access: Read 13:39:13,6336006 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86 SUCCESS Type: REG_BINARY, Length: 8, Data: 8B 43 2C 4B CB 3B CA 01 13:39:13,6339193 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:21, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:21, ChangeTime: 15/02/2011 20:25:11, AllocationSize: 11 485 184, EndOfFile: 11 485 184, FileAttributes: A 13:39:13,6340738 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6341808 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6341893 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS AllocationSize: 11 485 184, EndOfFile: 11 485 184, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6342027 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6343077 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS 13:39:13,6344936 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:21, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:21, ChangeTime: 15/02/2011 20:25:11, AllocationSize: 11 485 184, EndOfFile: 11 485 184, FileAttributes: A 13:39:13,6346297 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:21, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:21, ChangeTime: 15/02/2011 20:25:11, AllocationSize: 11 485 184, EndOfFile: 11 485 184, FileAttributes: A 13:39:13,6347759 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6349538 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6350254 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6351453 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS 13:39:13,6374932 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Image Base: 0x790c0000, Image Size: 0xaf7000 13:39:13,6376488 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll SUCCESS CreationTime: 18/03/2010 10:09:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 10:09:00, ChangeTime: 15/02/2011 22:19:50, AllocationSize: 299 008, EndOfFile: 297 808, FileAttributes: A 13:39:13,6380925 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6382250 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI NO SUCH FILE Filter: mscorlib.INI 13:39:13,6383542 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089 SUCCESS 13:39:13,6387086 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,6387723 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6387936 SexyCity.exe 564 QueryDirectory C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Filter: SexyCity.exe, 1: SexyCity.exe 13:39:13,6388211 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0 SUCCESS 13:39:13,6389158 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,6389457 SexyCity.exe 564 CreateFile C:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6389647 SexyCity.exe 564 QueryDirectory C:\Program Files SUCCESS Filter: Program Files, 1: Program Files 13:39:13,6389912 SexyCity.exe 564 CloseFile C:\ SUCCESS 13:39:13,6390592 SexyCity.exe 564 CreateFile C:\Program Files SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6390792 SexyCity.exe 564 QueryDirectory C:\Program Files\Sexy City SUCCESS Filter: Sexy City, 1: Sexy City 13:39:13,6391079 SexyCity.exe 564 CloseFile C:\Program Files SUCCESS 13:39:13,6391769 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6391972 SexyCity.exe 564 QueryDirectory C:\Program Files\Sexy City\2.0.0 SUCCESS Filter: 2.0.0, 1: 2.0.0 13:39:13,6392216 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City SUCCESS 13:39:13,6394069 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ole32.dll NAME NOT FOUND 13:39:13,6395208 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ole32.dll NAME NOT FOUND 13:39:13,6397328 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\rpcss.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:38:43, LastWriteTime: 26/07/2005 05:40:00, ChangeTime: 08/09/2007 16:02:04, AllocationSize: 401 408, EndOfFile: 397 824, FileAttributes: A 13:39:13,6398874 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\rpcss.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6399900 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\rpcss.dll SUCCESS AllocationSize: 401 408, EndOfFile: 397 824, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6400876 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\rpcss.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,6401961 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\rpcss.dll SUCCESS 13:39:13,6403293 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\rpcss.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6404333 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\rpcss.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6404403 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\rpcss.dll SUCCESS AllocationSize: 401 408, EndOfFile: 397 824, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6404517 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\rpcss.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6405543 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\rpcss.dll SUCCESS 13:39:13,6408127 SexyCity.exe 564 RegCreateKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS Desired Access: Set Value 13:39:13,6408578 SexyCity.exe 564 RegSetValue HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed SUCCESS Type: REG_BINARY, Length: 80, Data: 4E 97 5D 2C E6 6C CA AA 1A C3 6A 2F DD 89 72 16 13:39:13,6409416 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS 13:39:13,6410097 SexyCity.exe 564 RegCreateKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS Desired Access: Set Value 13:39:13,6410345 SexyCity.exe 564 RegSetValue HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed SUCCESS Type: REG_BINARY, Length: 80, Data: 67 CB 72 EE 2A 60 EE 0F 60 5D 30 BD C9 05 BF 5F 13:39:13,6410549 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS 13:39:13,6411266 SexyCity.exe 564 RegCreateKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS Desired Access: Set Value 13:39:13,6411505 SexyCity.exe 564 RegSetValue HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed SUCCESS Type: REG_BINARY, Length: 80, Data: 97 84 B2 AC 19 24 A9 76 B8 54 AA F7 16 EA 81 81 13:39:13,6411704 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS 13:39:13,6412329 SexyCity.exe 564 RegCreateKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS Desired Access: Set Value 13:39:13,6412569 SexyCity.exe 564 RegSetValue HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed SUCCESS Type: REG_BINARY, Length: 80, Data: EC 5D C6 A0 27 4B 88 76 96 13 A2 6B 4C BD 84 28 13:39:13,6412764 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS 13:39:13,6413390 SexyCity.exe 564 RegCreateKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS Desired Access: Set Value 13:39:13,6413623 SexyCity.exe 564 RegSetValue HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed SUCCESS Type: REG_BINARY, Length: 80, Data: AA 6C 2A 31 43 08 A3 44 06 9D 5A 58 8C 2E 0C 84 13:39:13,6413818 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS 13:39:13,6414442 SexyCity.exe 564 RegCreateKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS Desired Access: Set Value 13:39:13,6414676 SexyCity.exe 564 RegSetValue HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed SUCCESS Type: REG_BINARY, Length: 80, Data: 5A 4B 82 CC D2 A2 E4 E7 36 55 84 E1 CE 25 8C 6C 13:39:13,6414873 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS 13:39:13,6415496 SexyCity.exe 564 RegCreateKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS Desired Access: Set Value 13:39:13,6415728 SexyCity.exe 564 RegSetValue HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed SUCCESS Type: REG_BINARY, Length: 80, Data: 49 3A DF 9D 96 92 E3 70 72 1B 9C 00 6B 01 A1 CD 13:39:13,6415921 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\RNG SUCCESS 13:39:13,6417990 SexyCity.exe 564 QueryOpen C:\Program Files\RocketDock\RocketDock.dll SUCCESS CreationTime: 16/02/2011 09:53:38, LastAccessTime: 17/02/2011 13:37:39, LastWriteTime: 02/09/2007 13:57:36, ChangeTime: 16/02/2011 09:53:38, AllocationSize: 69 632, EndOfFile: 69 632, FileAttributes: A 13:39:13,6418654 SexyCity.exe 564 CreateFile C:\Program Files\RocketDock\RocketDock.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6418861 SexyCity.exe 564 CreateFileMapping C:\Program Files\RocketDock\RocketDock.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6418932 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\RocketDock\RocketDock.dll SUCCESS AllocationSize: 69 632, EndOfFile: 69 632, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6419049 SexyCity.exe 564 CreateFileMapping C:\Program Files\RocketDock\RocketDock.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6419234 SexyCity.exe 564 CloseFile C:\Program Files\RocketDock\RocketDock.dll SUCCESS 13:39:13,6420021 SexyCity.exe 564 QueryOpen C:\Program Files\RocketDock\RocketDock.dll SUCCESS CreationTime: 16/02/2011 09:53:38, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/09/2007 13:57:36, ChangeTime: 16/02/2011 09:53:38, AllocationSize: 69 632, EndOfFile: 69 632, FileAttributes: A 13:39:13,6420513 SexyCity.exe 564 QueryOpen C:\Program Files\RocketDock\RocketDock.dll SUCCESS CreationTime: 16/02/2011 09:53:38, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/09/2007 13:57:36, ChangeTime: 16/02/2011 09:53:38, AllocationSize: 69 632, EndOfFile: 69 632, FileAttributes: A 13:39:13,6421089 SexyCity.exe 564 CreateFile C:\Program Files\RocketDock\RocketDock.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6421284 SexyCity.exe 564 CreateFileMapping C:\Program Files\RocketDock\RocketDock.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6421531 SexyCity.exe 564 CreateFileMapping C:\Program Files\RocketDock\RocketDock.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6421727 SexyCity.exe 564 CloseFile C:\Program Files\RocketDock\RocketDock.dll SUCCESS 13:39:13,6449104 SexyCity.exe 564 Load Image C:\Program Files\RocketDock\RocketDock.dll SUCCESS Image Base: 0x10000000, Image Size: 0x12000 13:39:13,6449422 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,6449919 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,6450050 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,6450258 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,6450428 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,6450533 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,6451406 SexyCity.exe 564 CreateFile C:\Program Files\RocketDock\RocketDock.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6452137 SexyCity.exe 564 CreateFile C:\Program Files\RocketDock\RocketDock.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6456437 SexyCity.exe 564 CreateFile C:\Program Files\RocketDock\RocketDock.dll.2.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6456954 SexyCity.exe 564 CreateFile C:\Program Files\RocketDock\RocketDock.dll.2.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,6460910 SexyCity.exe 564 QueryOpen C:\Program Files\RocketDock\PSAPI.DLL NAME NOT FOUND 13:39:13,6462367 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\psapi.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:37:39, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 17/02/2011 10:23:45, AllocationSize: 24 576, EndOfFile: 23 040, FileAttributes: A 13:39:13,6464146 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\psapi.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6465301 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\psapi.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6465579 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\psapi.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6466656 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\psapi.dll SUCCESS 13:39:13,6499491 SexyCity.exe 564 Load Image C:\WINDOWS\system32\psapi.dll SUCCESS Image Base: 0x76ba0000, Image Size: 0xb000 13:39:13,6500409 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSAPI.DLL NAME NOT FOUND Desired Access: Read 13:39:13,6500689 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RocketDock.dll NAME NOT FOUND Desired Access: Read 13:39:13,6503283 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorlib.ni.dll NAME NOT FOUND Desired Access: Read 13:39:13,6506904 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\msctf.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/02/2008 13:00:31, ChangeTime: 28/05/2008 21:52:30, AllocationSize: 294 912, EndOfFile: 294 912, FileAttributes: A 13:39:13,6508718 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msctf.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6510356 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msctf.dll SUCCESS AllocationSize: 294 912, EndOfFile: 294 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6511489 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msctf.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,6512902 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msctf.dll SUCCESS 13:39:13,6514583 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msctf.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6515791 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msctf.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6515878 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msctf.dll SUCCESS AllocationSize: 294 912, EndOfFile: 294 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6516006 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msctf.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6517412 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msctf.dll SUCCESS 13:39:13,6519800 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\msctf.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/02/2008 13:00:31, ChangeTime: 28/05/2008 21:52:30, AllocationSize: 294 912, EndOfFile: 294 912, FileAttributes: A 13:39:13,6522176 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msctf.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6523525 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\msctf.dll SUCCESS AllocationSize: 294 912, EndOfFile: 294 912, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6524705 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\msctf.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,6525963 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msctf.dll SUCCESS 13:39:13,6528326 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\msctf.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6529622 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msctf.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6529995 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\msctf.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6531406 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\msctf.dll SUCCESS 13:39:13,6552549 SexyCity.exe 564 Load Image C:\WINDOWS\system32\msctf.dll SUCCESS Image Base: 0x74690000, Image Size: 0x4b000 13:39:13,6554579 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll NAME NOT FOUND Desired Access: Read 13:39:13,6556723 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\ntdll.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:04, AllocationSize: 733 184, EndOfFile: 733 184, FileAttributes: A 13:39:13,6559043 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\imm32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:03, AllocationSize: 110 592, EndOfFile: 110 080, FileAttributes: A 13:39:13,6560216 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\Compatibility\SexyCity.exe NAME NOT FOUND Desired Access: Read 13:39:13,6560357 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\SystemShared SUCCESS Desired Access: Read 13:39:13,6560717 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\SystemShared\CUAS SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,6560849 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\IMM SUCCESS Desired Access: Read 13:39:13,6561267 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM\IME File SUCCESS Type: REG_SZ, Length: 26, Data: msctfime.ime 13:39:13,6561393 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM\IME File SUCCESS Type: REG_SZ, Length: 26, Data: msctfime.ime 13:39:13,6561554 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM SUCCESS 13:39:13,6561675 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\SystemShared SUCCESS 13:39:13,6562452 SexyCity.exe 564 RegOpenKey HKCU\Keyboard Layout\Toggle SUCCESS Desired Access: Read 13:39:13,6562741 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,6562898 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,6562973 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,6563047 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,6563197 SexyCity.exe 564 RegCloseKey HKCU\Keyboard Layout\Toggle SUCCESS 13:39:13,6564959 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\kernel32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 16/04/2007 16:53:11, ChangeTime: 08/09/2007 16:02:04, AllocationSize: 1 052 672, EndOfFile: 1 049 600, FileAttributes: A 13:39:13,6565218 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,6565524 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,6565645 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,6565901 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,6566066 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,6566169 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,6566320 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF SUCCESS Desired Access: Read 13:39:13,6566551 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\EnableAnchorContext NAME NOT FOUND Length: 144 13:39:13,6566666 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF SUCCESS 13:39:13,6572715 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework\Policy\AppPatch SUCCESS Desired Access: Read 13:39:13,6573880 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319 SUCCESS CreationTime: 23/09/2010 05:01:25, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 17/02/2011 10:25:41, ChangeTime: 17/02/2011 10:25:41, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,6574125 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\AppPatch\v4.0.30319.00000 SUCCESS Desired Access: Read 13:39:13,6574765 SexyCity.exe 564 ReadFile C:\WINDOWS\system32\ole32.dll SUCCESS Offset: 664 576, Length: 8 192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:13,6575069 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\AppPatch SUCCESS 13:39:13,6575183 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\AppPatch\v4.0.30319.00000\mscorwks.dll NAME NOT FOUND Desired Access: Read 13:39:13,6575779 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework\policy\AppPatch\v4.0.30319.00000 SUCCESS 13:39:13,6577646 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS Desired Access: Maximum Allowed 13:39:13,6578055 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache SUCCESS Type: REG_EXPAND_SZ, Length: 108, Data: %USERPROFILE%\Local Settings\Temporary Internet Files 13:39:13,6578328 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS 13:39:13,6579645 SexyCity.exe 564 QueryOpen C:\Documents and Settings\DAMIEN\Local Settings\Temporary Internet Files SUCCESS CreationTime: 09/06/2007 09:50:31, LastAccessTime: 17/02/2011 13:09:13, LastWriteTime: 16/02/2011 00:24:11, ChangeTime: 17/02/2011 13:03:28, AllocationSize: 0, EndOfFile: 0, FileAttributes: HSDNCI 13:39:13,6579841 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders SUCCESS Desired Access: Maximum Allowed 13:39:13,6580221 SexyCity.exe 564 RegSetValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache SUCCESS Type: REG_SZ, Length: 146, Data: C:\Documents and Settings\DAMIEN\Local Settings\Temporary Internet Files 13:39:13,6580494 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders SUCCESS 13:39:13,6582307 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.config NAME NOT FOUND 13:39:13,6583301 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,6583669 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 SUCCESS Desired Access: Read 13:39:13,6584000 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex SUCCESS Type: REG_DWORD, Length: 4, Data: 843 13:39:13,6584248 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 SUCCESS 13:39:13,6584496 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\71b4a17e\670188fc NAME NOT FOUND Desired Access: Read 13:39:13,6584855 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\NET Framework Setup\DotNetClient\v3.5 NAME NOT FOUND Desired Access: Read 13:39:13,6585783 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6586065 SexyCity.exe 564 QueryDirectory C:\Program Files\Sexy City\2.0.0\SexyCity.INI NO SUCH FILE Filter: SexyCity.INI 13:39:13,6586277 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0 SUCCESS 13:39:13,6595717 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\l_intl.nls SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6596981 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\l_intl.nls SUCCESS AllocationSize: 8 192, EndOfFile: 7 046, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6598087 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\l_intl.nls SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,6599304 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\l_intl.nls SUCCESS 13:39:13,6600875 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\l_intl.nls SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6602518 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\l_intl.nls SUCCESS AllocationSize: 8 192, EndOfFile: 7 046, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6603616 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\l_intl.nls SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,6603699 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\l_intl.nls SUCCESS AllocationSize: 8 192, EndOfFile: 7 046, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6603836 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\l_intl.nls SUCCESS SyncType: SyncTypeOther 13:39:13,6605091 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\l_intl.nls SUCCESS 13:39:13,6607857 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6608439 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS AllocationSize: 2 101 248, EndOfFile: 2 097 664, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6608893 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,6608969 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS AllocationSize: 2 101 248, EndOfFile: 2 097 664, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6609099 SexyCity.exe 564 CreateFileMapping C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS SyncType: SyncTypeOther 13:39:13,6609611 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\StrongName NAME NOT FOUND Desired Access: Read 13:39:13,6610868 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS 13:39:13,6612188 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Fusion\PublisherPolicy\Default SUCCESS Desired Access: Read 13:39:13,6612610 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest SUCCESS Type: REG_DWORD, Length: 4, Data: 6 13:39:13,6614497 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\pubpol6.dat SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6776841 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index6 SUCCESS Type: REG_BINARY, Length: 1, Data: 1F 13:39:13,6777065 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp SUCCESS Type: REG_BINARY, Length: 8, Data: 00 00 00 00 00 00 00 00 13:39:13,6784542 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC\PublisherPolicy.tme NAME NOT FOUND 13:39:13,6788677 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS CreationTime: 23/09/2005 06:28:48, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 16/02/2011 13:33:09, ChangeTime: 16/02/2011 13:33:09, AllocationSize: 28 672, EndOfFile: 25 605, FileAttributes: A 13:39:13,6790209 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6790975 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS AllocationSize: 28 672, EndOfFile: 25 605, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6791680 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,6793426 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS CreationTime: 23/09/2005 06:28:48, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 16/02/2011 13:33:09, ChangeTime: 16/02/2011 13:33:09, FileAttributes: A 13:39:13,6794307 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 0, Length: 1 024 13:39:13,6795332 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS 13:39:13,6797253 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6798334 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 0, Length: 4 095 13:39:13,6801792 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 4 095, Length: 6 266 13:39:13,6803755 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 10 361, Length: 4 279 13:39:13,6805432 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 14 640, Length: 4 176 13:39:13,6808253 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS Offset: 18 816, Length: 4 273 13:39:13,6812307 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config SUCCESS 13:39:13,6813214 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a NAME NOT FOUND Desired Access: Read 13:39:13,6813560 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9 NAME NOT FOUND Desired Access: Read 13:39:13,6814239 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_32\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a PATH NOT FOUND 13:39:13,6816021 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a SUCCESS CreationTime: 15/02/2011 20:24:54, LastAccessTime: 17/02/2011 13:39:12, LastWriteTime: 15/02/2011 20:24:54, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,6817604 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 659 456, EndOfFile: 659 456, FileAttributes: A 13:39:13,6825665 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6826903 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,6827270 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6863753 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Image Base: 0x5e430000, Image Size: 0xa6000 13:39:13,6888462 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Image Base: 0x1210000, Image Size: 0xa6000 13:39:13,6891749 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,6892941 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI NO SUCH FILE Filter: Microsoft.VisualBasic.INI 13:39:13,6894341 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a SUCCESS 13:39:13,6901693 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,6936021 SexyCity.exe 564 QueryInformationVolume C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll BUFFER OVERFLOW VolumeCreationTime: 09/06/2007 11:31:13, VolumeSerialNumber: 0850-08A8, SupportsObjects: True, VolumeLabel: Win# 13:39:13,6937220 SexyCity.exe 564 QueryAllInformationFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll BUFFER OVERFLOW CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, FileAttributes: A, AllocationSize: 659 456, EndOfFile: 659 456, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x300000003ee67, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word 13:39:13,6938320 SexyCity.exe 564 QueryInformationVolume C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll BUFFER OVERFLOW VolumeCreationTime: 09/06/2007 11:31:13, VolumeSerialNumber: 0850-08A8, SupportsObjects: True, VolumeLabel: Win. 13:39:13,6939440 SexyCity.exe 564 QueryAllInformationFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll BUFFER OVERFLOW CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, FileAttributes: A, AllocationSize: 659 456, EndOfFile: 659 456, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x300000003ee67, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word 13:39:13,6947322 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 659 456, EndOfFile: 659 456, FileAttributes: A 13:39:13,6948899 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6949936 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6950009 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS AllocationSize: 659 456, EndOfFile: 659 456, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,6950134 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6951196 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS 13:39:13,6960225 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 659 456, EndOfFile: 659 456, FileAttributes: A 13:39:13,6961813 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 659 456, EndOfFile: 659 456, FileAttributes: A 13:39:13,6963500 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,6965300 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,6965639 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS SyncType: SyncTypeOther 13:39:13,6966848 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS 13:39:13,6998303 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS Image Base: 0x5e430000, Image Size: 0xa6000 13:39:13,7000250 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll SUCCESS CreationTime: 18/03/2010 10:09:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 10:09:00, ChangeTime: 15/02/2011 22:19:50, AllocationSize: 299 008, EndOfFile: 297 808, FileAttributes: A 13:39:13,7001914 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS 13:39:13,7012046 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS CreationTime: 25/07/2008 10:17:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:00, ChangeTime: 15/02/2011 20:25:41, AllocationSize: 368 640, EndOfFile: 367 104, FileAttributes: A 13:39:13,7013489 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,7014347 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS AllocationSize: 368 640, EndOfFile: 367 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,7015177 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,7016114 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS 13:39:13,7017415 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7018303 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7018383 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS AllocationSize: 368 640, EndOfFile: 367 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,7018522 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7019424 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS 13:39:13,7021213 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS CreationTime: 25/07/2008 10:17:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:00, ChangeTime: 15/02/2011 20:25:41, AllocationSize: 368 640, EndOfFile: 367 104, FileAttributes: A 13:39:13,7022572 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS CreationTime: 25/07/2008 10:17:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:00, ChangeTime: 15/02/2011 20:25:41, AllocationSize: 368 640, EndOfFile: 367 104, FileAttributes: A 13:39:13,7033803 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,7034794 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS AllocationSize: 368 640, EndOfFile: 367 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,7035582 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,7036486 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS 13:39:13,7038703 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7039621 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7039906 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7040824 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS 13:39:13,7064391 SexyCity.exe 564 Load Image C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll SUCCESS Image Base: 0x79060000, Image Size: 0x5b000 13:39:13,7064787 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,7065299 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,7065438 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,7065726 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,7065932 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,7066032 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,7067792 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,7069034 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,7070093 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll.2.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,7071106 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll.2.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,7147472 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots NAME NOT FOUND Desired Access: Enumerate Sub Keys 13:39:13,7148139 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe.Local NAME NOT FOUND 13:39:13,7149328 SexyCity.exe 564 QueryOpen C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS CreationTime: 21/05/2010 14:49:41, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 21/05/2010 14:49:41, ChangeTime: 21/05/2010 14:49:41, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,7150487 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,7151139 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorjit.dll NAME NOT FOUND Desired Access: Read 13:39:13,7151624 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Microsoft.VisualBasic.dll NAME NOT FOUND Desired Access: Read 13:39:13,7158274 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089 NAME NOT FOUND Desired Access: Read 13:39:13,7158624 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064 SUCCESS Desired Access: Read 13:39:13,7159172 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064 SUCCESS Index: 0, Name: e 13:39:13,7159290 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064 NO MORE ENTRIES Index: 1, Length: 288 13:39:13,7159456 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064 SUCCESS 13:39:13,7159630 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e SUCCESS Desired Access: Read 13:39:13,7159937 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\DisplayName SUCCESS Type: REG_SZ, Length: 94, Data: System.Windows.Forms,2.0.0.0,,b77a5c561934e089 13:39:13,7160125 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\ConfigMask SUCCESS Type: REG_DWORD, Length: 4, Data: 4361 13:39:13,7160247 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\ConfigString SUCCESS Type: REG_SZ, Length: 2, Data: 13:39:13,7160342 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\MVID SUCCESS Type: REG_BINARY, Length: 16, Data: 9A 25 4C 45 58 92 C0 23 55 AB 0A B0 F0 72 7C 5B 13:39:13,7160499 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e SUCCESS 13:39:13,7160669 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e SUCCESS Desired Access: Read 13:39:13,7160917 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\EvalationData NAME NOT FOUND Length: 144 13:39:13,7161020 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,7161115 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\ILDependencies BUFFER OVERFLOW Length: 144 13:39:13,7161209 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\ILDependencies SUCCESS Type: REG_BINARY, Length: 140, Data: 40 CE 5D 47 4E 6A 85 03 0E 00 00 00 02 00 00 00 13:39:13,7161345 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\NIDependencies SUCCESS Type: REG_BINARY, Length: 60, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00 13:39:13,7161460 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e\MissingDependencies NAME NOT FOUND Length: 144 13:39:13,7161589 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\e SUCCESS 13:39:13,7161719 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\3856a4e\e SUCCESS Desired Access: Read 13:39:13,7162325 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\3856a4e\e\DisplayName SUCCESS Type: REG_SZ, Length: 84, Data: System.Security,2.0.0.0,,b03f5f7f11d50a3a 13:39:13,7162591 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\3856a4e\e\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7162708 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\3856a4e\e\Modules NAME NOT FOUND Length: 144 13:39:13,7162796 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\3856a4e\e\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: EF 55 20 2B A0 9B EB 44 85 71 87 63 CF 6C 5A F5 13:39:13,7162902 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\3856a4e\e\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: E9 6D 41 4E CB 3B CA 01 13:39:13,7163047 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\3856a4e\e SUCCESS 13:39:13,7163246 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\61dc497f\6 SUCCESS Desired Access: Read 13:39:13,7163664 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\61dc497f\6\DisplayName SUCCESS Type: REG_SZ, Length: 74, Data: System.Xml,2.0.0.0,,b77a5c561934e089 13:39:13,7163842 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\61dc497f\6\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7163945 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\61dc497f\6\Modules NAME NOT FOUND Length: 144 13:39:13,7164032 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\61dc497f\6\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: D0 52 33 C6 D4 04 58 49 AA 20 65 55 DC 9F A6 AA 13:39:13,7164134 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\61dc497f\6\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: FB D5 C7 4D CB 3B CA 01 13:39:13,7164280 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\61dc497f\6 SUCCESS 13:39:13,7164474 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\11bd3c34\a SUCCESS Desired Access: Read 13:39:13,7164864 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\11bd3c34\a\DisplayName SUCCESS Type: REG_SZ, Length: 80, Data: Accessibility,2.0.0.0,,b03f5f7f11d50a3a 13:39:13,7165039 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\11bd3c34\a\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7165144 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\11bd3c34\a\Modules NAME NOT FOUND Length: 144 13:39:13,7165235 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\11bd3c34\a\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: 76 DA B5 EB 55 E6 F9 4E B8 0E 7B E7 55 DC C9 F0 13:39:13,7165384 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\11bd3c34\a\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: 41 D7 FF 41 CB 3B CA 01 13:39:13,7165547 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\11bd3c34\a SUCCESS 13:39:13,7165752 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\2bfe65de\5 SUCCESS Desired Access: Read 13:39:13,7166326 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\2bfe65de\5\DisplayName SUCCESS Type: REG_SZ, Length: 94, Data: System.Configuration,2.0.0.0,,b03f5f7f11d50a3a 13:39:13,7166558 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\2bfe65de\5\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7166668 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\2bfe65de\5\Modules NAME NOT FOUND Length: 144 13:39:13,7166761 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\2bfe65de\5\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: 16 1D D8 3C 6D 80 D2 46 86 5F CA CF 9E BC C6 8C 13:39:13,7166873 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\2bfe65de\5\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: 69 AA 77 4C CB 3B CA 01 13:39:13,7167025 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\2bfe65de\5 SUCCESS 13:39:13,7167244 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\286a445d\c SUCCESS Desired Access: Read 13:39:13,7167698 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\286a445d\c\DisplayName BUFFER OVERFLOW Length: 144 13:39:13,7167832 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\286a445d\c\DisplayName SUCCESS Type: REG_SZ, Length: 142, Data: System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a 13:39:13,7167979 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\286a445d\c\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7168081 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\286a445d\c\Modules NAME NOT FOUND Length: 144 13:39:13,7168172 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\286a445d\c\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: 07 D5 1B F7 D6 FF 79 40 93 77 E9 BC D3 32 EE AA 13:39:13,7168352 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\286a445d\c\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: 89 85 40 47 CB 3B CA 01 13:39:13,7168495 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\286a445d\c SUCCESS 13:39:13,7168698 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\32e43dd1\b SUCCESS Desired Access: Read 13:39:13,7169111 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\32e43dd1\b\DisplayName SUCCESS Type: REG_SZ, Length: 88, Data: System.Deployment,2.0.0.0,,b03f5f7f11d50a3a 13:39:13,7169284 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\32e43dd1\b\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7169388 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\32e43dd1\b\Modules NAME NOT FOUND Length: 144 13:39:13,7169475 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\32e43dd1\b\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: 59 34 AC 77 01 18 8D 45 A0 28 0A 40 61 F9 00 D7 13:39:13,7169587 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\32e43dd1\b\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: 53 20 7C 47 CB 3B CA 01 13:39:13,7169729 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\32e43dd1\b SUCCESS 13:39:13,7169919 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\3880e29a\10 SUCCESS Desired Access: Read 13:39:13,7170355 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\3880e29a\10\DisplayName SUCCESS Type: REG_SZ, Length: 94, Data: System.Windows.Forms,2.0.0.0,,b77a5c561934e089 13:39:13,7170536 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\3880e29a\10\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7170640 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\3880e29a\10\Modules NAME NOT FOUND Length: 144 13:39:13,7170730 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\3880e29a\10\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: 4C A9 A5 E2 FB 0B CD 4D A7 0D 13 8C F0 52 A0 ED 13:39:13,7170838 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\3880e29a\10\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: 8F EF F0 3F CB 3B CA 01 13:39:13,7170986 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\3880e29a\10 SUCCESS 13:39:13,7171222 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7 SUCCESS Desired Access: Read 13:39:13,7171601 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\DisplayName SUCCESS Type: REG_SZ, Length: 66, Data: System,2.0.0.0,,b77a5c561934e089 13:39:13,7171773 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\ConfigMask SUCCESS Type: REG_DWORD, Length: 4, Data: 4361 13:39:13,7171893 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\ConfigString SUCCESS Type: REG_SZ, Length: 2, Data: 13:39:13,7171991 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\MVID SUCCESS Type: REG_BINARY, Length: 16, Data: AA 79 26 46 0A 33 64 08 C8 04 13 30 AD 90 92 9D 13:39:13,7172109 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\EvalationData NAME NOT FOUND Length: 144 13:39:13,7172208 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,7172298 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\ILDependencies SUCCESS Type: REG_BINARY, Length: 60, Data: D8 D4 4B 42 DE 65 FE 2B 05 00 00 00 02 00 00 00 13:39:13,7172419 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\NIDependencies SUCCESS Type: REG_BINARY, Length: 20, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00 13:39:13,7172532 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7\MissingDependencies NAME NOT FOUND Length: 144 13:39:13,7172663 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\7 SUCCESS 13:39:13,7172890 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7540f5be\7 SUCCESS Desired Access: Read 13:39:13,7173406 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7540f5be\7\DisplayName SUCCESS Type: REG_SZ, Length: 66, Data: System,2.0.0.0,,b77a5c561934e089 13:39:13,7173562 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7540f5be\7\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7173663 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7540f5be\7\Modules NAME NOT FOUND Length: 144 13:39:13,7173748 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7540f5be\7\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: 65 42 B7 26 DF 9C A5 44 88 78 90 A2 5F 95 12 EE 13:39:13,7173857 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7540f5be\7\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: F9 63 17 45 CB 3B CA 01 13:39:13,7174002 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7540f5be\7 SUCCESS 13:39:13,7174283 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f SUCCESS Desired Access: Read 13:39:13,7174672 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\DisplayName SUCCESS Type: REG_SZ, Length: 82, Data: System.Drawing,2.0.0.0,,b03f5f7f11d50a3a 13:39:13,7174943 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\ConfigMask SUCCESS Type: REG_DWORD, Length: 4, Data: 4361 13:39:13,7175069 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\ConfigString SUCCESS Type: REG_SZ, Length: 2, Data: 13:39:13,7175166 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\MVID SUCCESS Type: REG_BINARY, Length: 16, Data: 69 78 F2 E9 0F 13 BC 72 0D 57 FA 68 95 C9 11 E2 13:39:13,7175282 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\EvalationData NAME NOT FOUND Length: 144 13:39:13,7175377 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,7175469 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\ILDependencies SUCCESS Type: REG_BINARY, Length: 20, Data: C0 D4 C7 6D B4 35 D9 7C 09 00 00 00 02 00 00 00 13:39:13,7175574 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\NIDependencies SUCCESS Type: REG_BINARY, Length: 40, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00 13:39:13,7175685 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\MissingDependencies NAME NOT FOUND Length: 144 13:39:13,7175814 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f SUCCESS 13:39:13,7175959 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\7cd935b4\9 SUCCESS Desired Access: Read 13:39:13,7176386 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\7cd935b4\9\DisplayName SUCCESS Type: REG_SZ, Length: 82, Data: System.Drawing,2.0.0.0,,b03f5f7f11d50a3a 13:39:13,7176563 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\7cd935b4\9\Status SUCCESS Type: REG_DWORD, Length: 4, Data: 4098 13:39:13,7176668 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\7cd935b4\9\Modules NAME NOT FOUND Length: 144 13:39:13,7176758 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\7cd935b4\9\SIG SUCCESS Type: REG_BINARY, Length: 36, Data: F0 78 56 6B 6A 39 C5 49 B7 F5 6C 51 02 21 1D 71 13:39:13,7176864 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\7cd935b4\9\LastModTime SUCCESS Type: REG_BINARY, Length: 8, Data: 83 EE 5E 4D CB 3B CA 01 13:39:13,7177007 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\7cd935b4\9 SUCCESS 13:39:13,7178216 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: 8F EF F0 3F CB 3B CA 01 13:39:13,7179121 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a NAME NOT FOUND Desired Access: Read 13:39:13,7179369 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: 83 EE 5E 4D CB 3B CA 01 13:39:13,7179952 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089 NAME NOT FOUND Desired Access: Read 13:39:13,7180172 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: F9 63 17 45 CB 3B CA 01 13:39:13,7180627 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089 NAME NOT FOUND Desired Access: Read 13:39:13,7180843 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: FB D5 C7 4D CB 3B CA 01 13:39:13,7181292 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a NAME NOT FOUND Desired Access: Read 13:39:13,7181517 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: 69 AA 77 4C CB 3B CA 01 13:39:13,7183796 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:34, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:34, ChangeTime: 15/02/2011 20:25:08, AllocationSize: 7 868 416, EndOfFile: 7 867 392, FileAttributes: A 13:39:13,7185556 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7186701 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7186788 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS AllocationSize: 7 868 416, EndOfFile: 7 867 392, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,7186925 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7188049 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS 13:39:13,7189806 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:34, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:34, ChangeTime: 15/02/2011 20:25:08, AllocationSize: 7 868 416, EndOfFile: 7 867 392, FileAttributes: A 13:39:13,7191167 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:34, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:34, ChangeTime: 15/02/2011 20:25:08, AllocationSize: 7 868 416, EndOfFile: 7 867 392, FileAttributes: A 13:39:13,7192623 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7193673 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7193994 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7195041 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS 13:39:13,7236508 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll SUCCESS Image Base: 0x7a440000, Image Size: 0x785000 13:39:13,7239903 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll SUCCESS CreationTime: 18/03/2010 10:09:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 10:09:00, ChangeTime: 15/02/2011 22:19:50, AllocationSize: 299 008, EndOfFile: 297 808, FileAttributes: A 13:39:13,7242557 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:48, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:48, ChangeTime: 15/02/2011 20:25:07, AllocationSize: 1 589 248, EndOfFile: 1 587 200, FileAttributes: A 13:39:13,7243902 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7244738 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7244833 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS AllocationSize: 1 589 248, EndOfFile: 1 587 200, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,7244977 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7245800 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS 13:39:13,7247610 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:48, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:48, ChangeTime: 15/02/2011 20:25:07, AllocationSize: 1 589 248, EndOfFile: 1 587 200, FileAttributes: A 13:39:13,7248743 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:48, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:48, ChangeTime: 15/02/2011 20:25:07, AllocationSize: 1 589 248, EndOfFile: 1 587 200, FileAttributes: A 13:39:13,7249989 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7250983 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7251414 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7252244 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS 13:39:13,7280260 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll SUCCESS Image Base: 0x7ade0000, Image Size: 0x188000 13:39:13,7281752 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll SUCCESS CreationTime: 18/03/2010 10:09:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 10:09:00, ChangeTime: 15/02/2011 22:19:50, AllocationSize: 299 008, EndOfFile: 297 808, FileAttributes: A 13:39:13,7283372 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a NAME NOT FOUND Desired Access: Read 13:39:13,7283663 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: 53 20 7C 47 CB 3B CA 01 13:39:13,7284227 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a NAME NOT FOUND Desired Access: Read 13:39:13,7284476 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: 89 85 40 47 CB 3B CA 01 13:39:13,7285193 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a NAME NOT FOUND Desired Access: Read 13:39:13,7285491 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: 41 D7 FF 41 CB 3B CA 01 13:39:13,7285949 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a NAME NOT FOUND Desired Access: Read 13:39:13,7286169 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL SUCCESS Type: REG_BINARY, Length: 8, Data: E9 6D 41 4E CB 3B CA 01 13:39:13,7287832 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:57, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:57, ChangeTime: 15/02/2011 20:25:02, AllocationSize: 12 431 360, EndOfFile: 12 428 800, FileAttributes: A 13:39:13,7289140 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7289969 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7290052 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS AllocationSize: 12 431 360, EndOfFile: 12 428 800, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,7290188 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7290986 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS 13:39:13,7292718 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:57, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:57, ChangeTime: 15/02/2011 20:25:02, AllocationSize: 12 431 360, EndOfFile: 12 428 800, FileAttributes: A 13:39:13,7293908 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS CreationTime: 22/09/2009 22:30:57, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:30:57, ChangeTime: 15/02/2011 20:25:02, AllocationSize: 12 431 360, EndOfFile: 12 428 800, FileAttributes: A 13:39:13,7295224 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7296037 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7296354 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7297278 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS 13:39:13,7321335 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll SUCCESS Image Base: 0x7afd0000, Image Size: 0xbdd000 13:39:13,7323164 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll SUCCESS CreationTime: 18/03/2010 10:09:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 10:09:00, ChangeTime: 15/02/2011 22:19:50, AllocationSize: 299 008, EndOfFile: 297 808, FileAttributes: A 13:39:13,7328142 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,7329335 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI NO SUCH FILE Filter: System.Windows.Forms.INI 13:39:13,7330535 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089 SUCCESS 13:39:13,7331093 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA NAME NOT FOUND Desired Access: Read 13:39:13,7611545 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,7613305 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI NO SUCH FILE Filter: System.INI 13:39:13,7614627 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089 SUCCESS 13:39:13,7767879 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,7769165 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI NO SUCH FILE Filter: System.Drawing.INI 13:39:13,7770229 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a SUCCESS 13:39:13,7779301 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VERSION.dll NAME NOT FOUND 13:39:13,7780456 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VERSION.dll NAME NOT FOUND 13:39:13,7782145 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 659 456, EndOfFile: 659 456, FileAttributes: A 13:39:13,7783632 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 659 456, EndOfFile: 659 456, FileAttributes: A 13:39:13,7785201 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 659 456, EndOfFile: 659 456, FileAttributes: A 13:39:13,7787093 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS CreationTime: 22/09/2009 22:25:53, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:25:53, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 659 456, EndOfFile: 659 456, FileAttributes: A 13:39:13,7844949 SexyCity.exe 564 QueryOpen C:\WINDOWS\Globalization\fr-fr.nlp PATH NOT FOUND 13:39:13,7845482 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,7846054 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,7846183 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,7846611 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,7846814 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,7846925 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,7851668 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\.NETFramework SUCCESS Desired Access: Read 13:39:13,7852370 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\DbgJITDebugLaunchSetting NAME NOT FOUND Length: 144 13:39:13,7852487 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger NAME NOT FOUND Length: 144 13:39:13,7852745 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\.NETFramework SUCCESS 13:39:13,7874528 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089 NAME NOT FOUND Desired Access: Read 13:39:13,7874981 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397 NAME NOT FOUND Desired Access: Read 13:39:13,7876073 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_32\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089 PATH NOT FOUND 13:39:13,7879042 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089 SUCCESS CreationTime: 15/02/2011 20:24:54, LastAccessTime: 17/02/2011 13:39:12, LastWriteTime: 15/02/2011 20:24:54, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,7880743 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS CreationTime: 22/09/2009 22:26:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:26:00, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 303 104, EndOfFile: 303 104, FileAttributes: A 13:39:13,7883072 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7884228 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,7884545 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7904090 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Image Base: 0x67770000, Image Size: 0x4c000 13:39:13,7922308 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Image Base: 0x12e0000, Image Size: 0x4c000 13:39:13,7925239 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,7926302 SexyCity.exe 564 QueryDirectory C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.INI NO SUCH FILE Filter: System.Runtime.Remoting.INI 13:39:13,7927337 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089 SUCCESS 13:39:13,7933226 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,7934321 SexyCity.exe 564 QueryInformationVolume C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll BUFFER OVERFLOW VolumeCreationTime: 09/06/2007 11:31:13, VolumeSerialNumber: 0850-08A8, SupportsObjects: True, VolumeLabel: Win. 13:39:13,7935308 SexyCity.exe 564 QueryAllInformationFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll BUFFER OVERFLOW CreationTime: 22/09/2009 22:26:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:26:00, ChangeTime: 15/02/2011 20:24:54, FileAttributes: A, AllocationSize: 303 104, EndOfFile: 303 104, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x300000003ee6a, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word 13:39:13,7936282 SexyCity.exe 564 QueryInformationVolume C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll BUFFER OVERFLOW VolumeCreationTime: 09/06/2007 11:31:13, VolumeSerialNumber: 0850-08A8, SupportsObjects: True, VolumeLabel: Win. 13:39:13,7937245 SexyCity.exe 564 QueryAllInformationFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll BUFFER OVERFLOW CreationTime: 22/09/2009 22:26:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:26:00, ChangeTime: 15/02/2011 20:24:54, FileAttributes: A, AllocationSize: 303 104, EndOfFile: 303 104, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x300000003ee6a, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word 13:39:13,7938769 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS CreationTime: 22/09/2009 22:26:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:26:00, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 303 104, EndOfFile: 303 104, FileAttributes: A 13:39:13,7940655 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7941722 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7941805 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS AllocationSize: 303 104, EndOfFile: 303 104, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,7941942 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7942979 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS 13:39:13,7944594 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS CreationTime: 22/09/2009 22:26:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:26:00, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 303 104, EndOfFile: 303 104, FileAttributes: A 13:39:13,7945942 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS CreationTime: 22/09/2009 22:26:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 22/09/2009 22:26:00, ChangeTime: 15/02/2011 20:24:54, AllocationSize: 303 104, EndOfFile: 303 104, FileAttributes: A 13:39:13,7947415 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,7948459 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,7948795 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS SyncType: SyncTypeOther 13:39:13,7949904 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS 13:39:13,7975428 SexyCity.exe 564 Load Image C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS Image Base: 0x67770000, Image Size: 0x4c000 13:39:13,7976918 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\mscoree.dll SUCCESS CreationTime: 18/03/2010 10:09:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 18/03/2010 10:09:00, ChangeTime: 15/02/2011 22:19:50, AllocationSize: 299 008, EndOfFile: 297 808, FileAttributes: A 13:39:13,7978533 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS 13:39:13,8217975 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll NAME NOT FOUND 13:39:13,8219635 SexyCity.exe 564 QueryOpen C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll NAME NOT FOUND 13:39:13,8221326 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,8221804 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,8221934 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,8222143 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,8222317 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,8222413 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,8224501 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8225592 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,8225672 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS AllocationSize: 5 025 792, EndOfFile: 5 025 792, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8225808 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS SyncType: SyncTypeOther 13:39:13,8227573 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8228911 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8230607 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8232254 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8331699 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll SUCCESS 13:39:13,8553816 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\IMM SUCCESS Desired Access: Maximum Allowed 13:39:13,8554424 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM\Ime File SUCCESS Type: REG_SZ, Length: 26, Data: msctfime.ime 13:39:13,8554632 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM SUCCESS 13:39:13,8556733 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8558366 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8559416 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8560399 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8561537 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8562894 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8563947 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,8564031 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8564161 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeOther 13:39:13,8565213 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8566921 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8568469 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8569481 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8570442 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8571460 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8572970 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8574007 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,8574076 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8574196 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeOther 13:39:13,8575567 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8577677 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8579224 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8580243 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8581213 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8582234 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8583794 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8584951 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,8585021 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8585146 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeOther 13:39:13,8586175 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8587764 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8589291 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8590303 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8591264 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8592275 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8593614 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8594720 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,8594789 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8594912 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeOther 13:39:13,8595940 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8621881 SexyCity.exe 564 Load Image C:\WINDOWS\system32\apphelp.dll SUCCESS Image Base: 0x77b50000, Image Size: 0x22000 13:39:13,8622673 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apphelp.dll NAME NOT FOUND Desired Access: Read 13:39:13,8622950 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System.ni.dll NAME NOT FOUND Desired Access: Read 13:39:13,8623120 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System.Drawing.ni.dll NAME NOT FOUND Desired Access: Read 13:39:13,8623345 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System.Windows.Forms.ni.dll NAME NOT FOUND Desired Access: Read 13:39:13,8623503 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System.Runtime.Remoting.dll NAME NOT FOUND Desired Access: Read 13:39:13,8623714 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility SUCCESS Desired Access: Query Value 13:39:13,8624179 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility\DisableAppCompat NAME NOT FOUND Length: 20 13:39:13,8624332 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility SUCCESS 13:39:13,8626321 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8627363 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8628568 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8629780 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 27/09/2010 09:40:22, LastWriteTime: 04/10/2006 15:06:21, ChangeTime: 25/03/2008 12:05:00, FileAttributes: A 13:39:13,8630949 SexyCity.exe 564 ReadFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Offset: 0, Length: 1 024 13:39:13,8632213 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:13,8634190 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8636005 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8637092 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,8637250 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8637441 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeOther 13:39:13,8638562 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8640403 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\systest.sdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8641701 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\systest.sdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a 13:39:13,8643295 SexyCity.exe 564 CreateFile C:\WINDOWS\system32 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8644050 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32\msctfime.ime SUCCESS Filter: msctfime.ime, 1: MSCTFIME.IME 13:39:13,8644897 SexyCity.exe 564 CloseFile C:\WINDOWS\system32 SUCCESS 13:39:13,8646345 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8646653 SexyCity.exe 564 CreateFile C:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8646845 SexyCity.exe 564 QueryDirectory C:\WINDOWS SUCCESS Filter: WINDOWS, 1: WINDOWS 13:39:13,8647099 SexyCity.exe 564 CloseFile C:\ SUCCESS 13:39:13,8648050 SexyCity.exe 564 CreateFile C:\WINDOWS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8648527 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 SUCCESS Filter: system32, 1: system32 13:39:13,8649064 SexyCity.exe 564 CloseFile C:\WINDOWS SUCCESS 13:39:13,8650288 SexyCity.exe 564 CreateFile C:\WINDOWS\system32 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8651030 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32\msctfime.ime SUCCESS Filter: msctfime.ime, 1: MSCTFIME.IME 13:39:13,8651853 SexyCity.exe 564 CloseFile C:\WINDOWS\system32 SUCCESS 13:39:13,8652112 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers SUCCESS Desired Access: Read, WOW64_64Key 13:39:13,8652578 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\WINDOWS\system32\MSCTFIME.IME NAME NOT FOUND Length: 1 024 13:39:13,8652750 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers SUCCESS 13:39:13,8652906 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers NAME NOT FOUND Desired Access: Read, WOW64_64Key 13:39:13,8653042 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\MSCTFIME.IME NAME NOT FOUND Desired Access: Read, WOW64_64Key 13:39:13,8655383 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:13,8657362 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8658845 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8659860 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8664637 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8665737 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8667096 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8668810 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,8668893 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8669021 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeOther 13:39:13,8670062 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8671677 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8673234 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8674243 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS AllocationSize: 180 224, EndOfFile: 177 152, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8675480 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8676502 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8677842 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8678871 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,8679136 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\MSCTFIME.IME SUCCESS SyncType: SyncTypeOther 13:39:13,8680193 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS 13:39:13,8705468 SexyCity.exe 564 Load Image C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Image Base: 0x75140000, Image Size: 0x2e000 13:39:13,8708997 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime NAME NOT FOUND Desired Access: Read 13:39:13,8712105 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\ole32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/07/2005 05:40:00, ChangeTime: 08/09/2007 16:02:12, AllocationSize: 1 286 144, EndOfFile: 1 284 608, FileAttributes: A 13:39:13,8715274 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\ntdll.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:04, AllocationSize: 733 184, EndOfFile: 733 184, FileAttributes: A 13:39:13,8715821 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF SUCCESS Desired Access: Maximum Allowed 13:39:13,8716235 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\CTF\Disable Thread Input Manager SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,8716416 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\CTF SUCCESS 13:39:13,8716828 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\CTF\SystemShared SUCCESS Desired Access: Maximum Allowed 13:39:13,8717140 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\SystemShared\CUAS SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,8717263 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\SystemShared SUCCESS 13:39:13,8719533 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8720557 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8721579 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8722583 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 27/09/2010 09:40:22, LastWriteTime: 04/10/2006 15:06:21, ChangeTime: 25/03/2008 12:05:00, FileAttributes: A 13:39:13,8723596 SexyCity.exe 564 ReadFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Offset: 0, Length: 1 024 13:39:13,8724669 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:13,8726009 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8727119 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8728054 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,8728132 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8728262 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeOther 13:39:13,8729277 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8730873 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\systest.sdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8732153 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\systest.sdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a 13:39:13,8733599 SexyCity.exe 564 CreateFile C:\WINDOWS\system32 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8734609 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32\msctfime.ime SUCCESS Filter: msctfime.ime, 1: MSCTFIME.IME 13:39:13,8735463 SexyCity.exe 564 CloseFile C:\WINDOWS\system32 SUCCESS 13:39:13,8736915 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8737218 SexyCity.exe 564 CreateFile C:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8737408 SexyCity.exe 564 QueryDirectory C:\WINDOWS SUCCESS Filter: WINDOWS, 1: WINDOWS 13:39:13,8737664 SexyCity.exe 564 CloseFile C:\ SUCCESS 13:39:13,8738616 SexyCity.exe 564 CreateFile C:\WINDOWS SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8739092 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32 SUCCESS Filter: system32, 1: system32 13:39:13,8739633 SexyCity.exe 564 CloseFile C:\WINDOWS SUCCESS 13:39:13,8741075 SexyCity.exe 564 CreateFile C:\WINDOWS\system32 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8741835 SexyCity.exe 564 QueryDirectory C:\WINDOWS\system32\msctfime.ime SUCCESS Filter: msctfime.ime, 1: MSCTFIME.IME 13:39:13,8742662 SexyCity.exe 564 CloseFile C:\WINDOWS\system32 SUCCESS 13:39:13,8742912 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers SUCCESS Desired Access: Read, WOW64_64Key 13:39:13,8743241 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\WINDOWS\system32\MSCTFIME.IME NAME NOT FOUND Length: 1 024 13:39:13,8743397 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers SUCCESS 13:39:13,8743548 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers NAME NOT FOUND Desired Access: Read, WOW64_64Key 13:39:13,8743680 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\MSCTFIME.IME NAME NOT FOUND Desired Access: Read, WOW64_64Key 13:39:13,8745910 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:13,8747566 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:13,8751150 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\msctf.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/02/2008 13:00:31, ChangeTime: 28/05/2008 21:52:30, AllocationSize: 294 912, EndOfFile: 294 912, FileAttributes: A 13:39:13,8751601 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF SUCCESS Desired Access: Maximum Allowed 13:39:13,8751892 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\CTF\Disable Thread Input Manager SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,8752032 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\CTF SUCCESS 13:39:13,8752109 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,8752379 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,8752542 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS Desired Access: Read 13:39:13,8752950 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS 13:39:13,8753103 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile NAME NOT FOUND Desired Access: Read 13:39:13,8753268 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS Desired Access: Read 13:39:13,8753552 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS Index: 0, Name: 0x00000000 13:39:13,8753640 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000 SUCCESS Desired Access: Read 13:39:13,8753915 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000 SUCCESS Index: 0, Name: {63800dac-e7ca-4df9-9a5c-20765055488d} 13:39:13,8753997 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} SUCCESS Desired Access: Read 13:39:13,8754377 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}\Enable NAME NOT FOUND Length: 144 13:39:13,8754533 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} SUCCESS 13:39:13,8754659 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000 SUCCESS 13:39:13,8754772 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS 13:39:13,8754876 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,8756142 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\Secur32.dll NAME NOT FOUND 13:39:13,8757587 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\secur32.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:04, AllocationSize: 57 344, EndOfFile: 55 808, FileAttributes: A 13:39:13,8759111 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\secur32.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8760472 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\secur32.dll SUCCESS AllocationSize: 57 344, EndOfFile: 55 808, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8761455 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\secur32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8762507 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\secur32.dll SUCCESS 13:39:13,8763870 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\secur32.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8764909 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\secur32.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,8765185 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\secur32.dll SUCCESS SyncType: SyncTypeOther 13:39:13,8766260 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\secur32.dll SUCCESS 13:39:13,8797482 SexyCity.exe 564 Load Image C:\WINDOWS\system32\secur32.dll SUCCESS Image Base: 0x77fc0000, Image Size: 0x11000 13:39:13,8798879 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll NAME NOT FOUND Desired Access: Read 13:39:13,8801657 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8801974 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\Com+Enabled SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,8802132 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8803204 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\CLBCATQ.DLL NAME NOT FOUND 13:39:13,8804898 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\clbcatq.dll SUCCESS CreationTime: 09/06/2007 09:43:10, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/07/2005 05:39:55, ChangeTime: 08/09/2007 16:02:07, AllocationSize: 499 712, EndOfFile: 498 688, FileAttributes: A 13:39:13,8806864 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\clbcatq.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8808195 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\clbcatq.dll SUCCESS AllocationSize: 499 712, EndOfFile: 498 688, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8809572 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\clbcatq.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8810833 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\clbcatq.dll SUCCESS 13:39:13,8812500 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\clbcatq.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8813874 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\clbcatq.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,8814196 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\clbcatq.dll SUCCESS SyncType: SyncTypeOther 13:39:13,8815536 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\clbcatq.dll SUCCESS 13:39:13,8844825 SexyCity.exe 564 Load Image C:\WINDOWS\system32\clbcatq.dll SUCCESS Image Base: 0x76f80000, Image Size: 0x7f000 13:39:13,8846455 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\COMRes.dll NAME NOT FOUND 13:39:13,8848412 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\comres.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 17/02/2011 10:26:32, AllocationSize: 851 968, EndOfFile: 851 968, FileAttributes: A 13:39:13,8850855 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comres.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8852148 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\system32\comres.dll SUCCESS AllocationSize: 851 968, EndOfFile: 851 968, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8853884 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\comres.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8855119 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comres.dll SUCCESS 13:39:13,8856636 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\comres.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,8858009 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comres.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,8858313 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\system32\comres.dll SUCCESS SyncType: SyncTypeOther 13:39:13,8859369 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\comres.dll SUCCESS 13:39:13,8886837 SexyCity.exe 564 Load Image C:\WINDOWS\system32\comres.dll SUCCESS Image Base: 0x77000000, Image Size: 0xd4000 13:39:13,8888654 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMRes.dll NAME NOT FOUND Desired Access: Read 13:39:13,8888896 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLBCATQ.DLL NAME NOT FOUND Desired Access: Read 13:39:13,8889488 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3\Debug NAME NOT FOUND Desired Access: All Access 13:39:13,8889617 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3\Debug NAME NOT FOUND Desired Access: Read 13:39:13,8889757 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\OLE SUCCESS Desired Access: Read 13:39:13,8890157 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Ole\MinimumFreeMemPercentageToCreateProcess NAME NOT FOUND Length: 144 13:39:13,8890253 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Ole\MinimumFreeMemPercentageToCreateObject NAME NOT FOUND Length: 144 13:39:13,8890492 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Ole SUCCESS 13:39:13,8891499 SexyCity.exe 564 QueryOpen C:\WINDOWS\Registration SUCCESS CreationTime: 09/06/2007 09:44:07, LastAccessTime: 17/02/2011 13:39:12, LastWriteTime: 15/02/2011 20:36:08, ChangeTime: 15/02/2011 20:36:08, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,8891790 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8892058 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\Com+Enabled SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,8892198 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8892909 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes SUCCESS Desired Access: Maximum Allowed 13:39:13,8893303 SexyCity.exe 564 RegOpenKey HKCR SUCCESS Desired Access: Maximum Allowed 13:39:13,8893779 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Maximum Allowed 13:39:13,8894369 SexyCity.exe 564 RegOpenKey HKU SUCCESS Desired Access: Notify 13:39:13,8894748 SexyCity.exe 564 RegOpenKey HKCR SUCCESS Desired Access: Maximum Allowed 13:39:13,8895052 SexyCity.exe 564 RegOpenKey HKU SUCCESS Desired Access: Notify 13:39:13,8895305 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Maximum Allowed 13:39:13,8895647 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Maximum Allowed 13:39:13,8895984 SexyCity.exe 564 RegOpenKey HKCR\CLSID SUCCESS Desired Access: Maximum Allowed 13:39:13,8896340 SexyCity.exe 564 RegOpenKey HKCR SUCCESS Desired Access: Maximum Allowed 13:39:13,8896739 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Maximum Allowed 13:39:13,8897069 SexyCity.exe 564 RegOpenKey HKU SUCCESS Desired Access: Notify 13:39:13,8897333 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Maximum Allowed 13:39:13,8897674 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Maximum Allowed 13:39:13,8898000 SexyCity.exe 564 RegOpenKey HKCR\CLSID SUCCESS Desired Access: Maximum Allowed 13:39:13,8898431 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8898720 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion SUCCESS Type: REG_BINARY, Length: 8, Data: 0F 00 00 00 00 00 00 00 13:39:13,8898860 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8900246 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000000f.clb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8901205 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000000f.clb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8901502 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8901765 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion SUCCESS Type: REG_BINARY, Length: 8, Data: 0F 00 00 00 00 00 00 00 13:39:13,8901897 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8902909 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000000f.clb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8903672 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000000f.clb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8903891 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8904129 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion SUCCESS Type: REG_BINARY, Length: 8, Data: 0F 00 00 00 00 00 00 00 13:39:13,8904261 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8905538 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000000f.clb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8906523 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000000f.clb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8906786 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8907026 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion SUCCESS Type: REG_BINARY, Length: 8, Data: 0F 00 00 00 00 00 00 00 13:39:13,8907164 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8908295 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000000f.clb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8909220 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000000f.clb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,8910403 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,8910994 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Registration\R????????????.clb SUCCESS Filter: R????????????.clb, 1: R000000000018.clb 13:39:13,8911678 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Registration SUCCESS 0: R000000000019.clb, 1: R00000000001a.clb, 2: R00000000001b.clb, 3: R00000000001c.clb 13:39:13,8912393 SexyCity.exe 564 QueryDirectory C:\WINDOWS\Registration NO MORE FILES 13:39:13,8912913 SexyCity.exe 564 CloseFile C:\WINDOWS\Registration SUCCESS 13:39:13,8914233 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8914901 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS AllocationSize: 24 576, EndOfFile: 23 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8915480 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Registration\R00000000001c.clb SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,8916003 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS CreationTime: 15/02/2011 20:36:08, LastAccessTime: 17/02/2011 13:38:43, LastWriteTime: 09/06/2007 10:54:45, ChangeTime: 08/09/2007 16:02:07, FileAttributes: A 13:39:13,8916601 SexyCity.exe 564 ReadFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS Offset: 0, Length: 1 024 13:39:13,8917712 SexyCity.exe 564 CloseFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS 13:39:13,8918423 SexyCity.exe 564 CreateFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,8918913 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS AllocationSize: 24 576, EndOfFile: 23 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,8919395 SexyCity.exe 564 ReadFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS Offset: 0, Length: 23 436 13:39:13,8920090 SexyCity.exe 564 CloseFile C:\WINDOWS\Registration\R00000000001c.clb SUCCESS 13:39:13,8921040 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8921318 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion SUCCESS Type: REG_BINARY, Length: 8, Data: 0F 00 00 00 00 00 00 00 13:39:13,8921454 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8921740 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8921835 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} NAME NOT FOUND Desired Access: Read 13:39:13,8921934 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Desired Access: Read 13:39:13,8922246 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8922400 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TreatAs NAME NOT FOUND Desired Access: Query Value 13:39:13,8922535 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TreatAs NAME NOT FOUND Desired Access: Query Value 13:39:13,8922633 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8922703 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes SUCCESS Desired Access: Read 13:39:13,8922874 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS 13:39:13,8922956 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8923028 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} NAME NOT FOUND Desired Access: Read 13:39:13,8923108 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Desired Access: Read 13:39:13,8923348 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8923491 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8923648 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocServer32 SUCCESS Desired Access: Maximum Allowed 13:39:13,8923909 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 SUCCESS Query: Name 13:39:13,8924053 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8924201 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32\InprocServer32 NAME NOT FOUND Length: 144 13:39:13,8924326 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 SUCCESS 13:39:13,8924408 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8924539 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocServerX86 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8924694 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocServerX86 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8924942 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8925104 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\LocalServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8925266 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\LocalServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8925437 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8925587 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8925794 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocServer32 SUCCESS Desired Access: Maximum Allowed 13:39:13,8926239 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 SUCCESS Query: Name 13:39:13,8926387 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8926546 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32\(Default) SUCCESS Type: REG_SZ, Length: 60, Data: C:\WINDOWS\system32\msctf.dll 13:39:13,8926679 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 SUCCESS 13:39:13,8926779 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8926913 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocHandler32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8927052 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocHandler32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8927182 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8927313 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocHandlerX86 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8927453 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocHandlerX86 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8927573 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8927703 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\LocalServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8927843 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\LocalServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8927955 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8928086 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\LocalServer NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8928539 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\LocalServer NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8928657 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8928734 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} NAME NOT FOUND Desired Access: Read 13:39:13,8928811 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Desired Access: Read 13:39:13,8929059 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8929198 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8929334 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\AppID NAME NOT FOUND Length: 144 13:39:13,8929456 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS 13:39:13,8929567 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS 13:39:13,8930068 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8930146 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} NAME NOT FOUND Desired Access: Read 13:39:13,8930226 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Desired Access: Read 13:39:13,8930466 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8930608 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8930747 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InprocServer32 SUCCESS Desired Access: Maximum Allowed 13:39:13,8930993 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 SUCCESS Query: Name 13:39:13,8931131 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8931279 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32\ThreadingModel SUCCESS Type: REG_SZ, Length: 20, Data: Apartment 13:39:13,8931411 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\InProcServer32 SUCCESS 13:39:13,8931529 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS 13:39:13,8931779 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes SUCCESS Desired Access: Maximum Allowed 13:39:13,8932029 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8932106 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} NAME NOT FOUND Desired Access: Read 13:39:13,8932185 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Desired Access: Read 13:39:13,8932431 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS Query: Name 13:39:13,8932569 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TreatAs NAME NOT FOUND Desired Access: Query Value 13:39:13,8932782 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TreatAs NAME NOT FOUND Desired Access: Query Value 13:39:13,8932936 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53} SUCCESS 13:39:13,8934517 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\msctf.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/02/2008 13:00:31, ChangeTime: 28/05/2008 21:52:30, AllocationSize: 294 912, EndOfFile: 294 912, FileAttributes: A 13:39:13,8935331 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8935578 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion SUCCESS Type: REG_BINARY, Length: 8, Data: 0F 00 00 00 00 00 00 00 13:39:13,8935707 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8935859 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\COM3 SUCCESS Desired Access: Read 13:39:13,8936071 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion SUCCESS Type: REG_BINARY, Length: 8, Data: 0F 00 00 00 00 00 00 00 13:39:13,8936188 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS 13:39:13,8936316 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8936395 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} NAME NOT FOUND Desired Access: Read 13:39:13,8936485 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Desired Access: Read 13:39:13,8936764 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8936915 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TreatAs NAME NOT FOUND Desired Access: Query Value 13:39:13,8937044 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TreatAs NAME NOT FOUND Desired Access: Query Value 13:39:13,8937143 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8937210 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes SUCCESS Desired Access: Read 13:39:13,8937381 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS 13:39:13,8937453 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8937524 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} NAME NOT FOUND Desired Access: Read 13:39:13,8937597 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Desired Access: Read 13:39:13,8937828 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8937969 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8938110 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocServer32 SUCCESS Desired Access: Maximum Allowed 13:39:13,8938401 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 SUCCESS Query: Name 13:39:13,8938541 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8938703 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32\InprocServer32 NAME NOT FOUND Length: 144 13:39:13,8938921 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 SUCCESS 13:39:13,8939013 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8939154 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocServerX86 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8939304 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocServerX86 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8939424 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8939557 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\LocalServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8939697 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\LocalServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8939816 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8939945 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8940080 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocServer32 SUCCESS Desired Access: Maximum Allowed 13:39:13,8940339 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 SUCCESS Query: Name 13:39:13,8940478 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8940619 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32\(Default) SUCCESS Type: REG_SZ, Length: 60, Data: C:\WINDOWS\system32\msctf.dll 13:39:13,8940743 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 SUCCESS 13:39:13,8940839 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8940971 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocHandler32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8941109 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocHandler32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8941236 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8941366 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocHandlerX86 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8941501 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocHandlerX86 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8941615 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8941743 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\LocalServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8941877 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\LocalServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8941987 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8942132 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\LocalServer NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8942265 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\LocalServer NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8942374 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8942445 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} NAME NOT FOUND Desired Access: Read 13:39:13,8942516 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Desired Access: Read 13:39:13,8942755 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8942885 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8943058 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\AppID NAME NOT FOUND Length: 144 13:39:13,8943232 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS 13:39:13,8943377 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS 13:39:13,8943643 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8943720 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} NAME NOT FOUND Desired Access: Read 13:39:13,8943799 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Desired Access: Read 13:39:13,8944049 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8944189 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8944325 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InprocServer32 SUCCESS Desired Access: Maximum Allowed 13:39:13,8944588 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 SUCCESS Query: Name 13:39:13,8944731 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,8944961 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32\ThreadingModel SUCCESS Type: REG_SZ, Length: 20, Data: Apartment 13:39:13,8945089 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\InProcServer32 SUCCESS 13:39:13,8945209 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS 13:39:13,8945318 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,8945395 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} NAME NOT FOUND Desired Access: Read 13:39:13,8945471 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Desired Access: Read 13:39:13,8945714 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS Query: Name 13:39:13,8945849 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TreatAs NAME NOT FOUND Desired Access: Query Value 13:39:13,8945977 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TreatAs NAME NOT FOUND Desired Access: Query Value 13:39:13,8946116 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7} SUCCESS 13:39:13,8946295 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,8946550 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,8946794 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8946932 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 1, Name: {531FDEBF-9B4C-4A43-A2AA-960E8FCDC732} 13:39:13,8947045 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8947274 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 2, Name: {70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC} 13:39:13,8947379 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8947579 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 3, Name: {766A2C14-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8947687 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8947814 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 4, Name: {766A2C15-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8947904 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8948098 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 5, Name: {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80} 13:39:13,8948187 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} SUCCESS Desired Access: Read 13:39:13,8948573 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} SUCCESS Index: 0, Name: {34B45670-7526-11D2-A147-00105A2799B5} 13:39:13,8948684 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NO MORE ENTRIES Index: 1, Length: 288 13:39:13,8948819 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} SUCCESS 13:39:13,8948910 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 6, Name: {86757E61-EA9E-11D3-9590-0000E843503E} 13:39:13,8949021 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-9590-0000E843503E}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8949255 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 7, Name: {B3209488-CB34-4017-8E13-10CFCA2519FE} 13:39:13,8949359 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E13-10CFCA2519FE}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8949753 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 8, Name: {C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82} 13:39:13,8949893 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8950207 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 9, Name: {DCBD6FA8-032F-11D3-B5B1-00C04FC324A1} 13:39:13,8950303 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} SUCCESS Desired Access: Read 13:39:13,8950785 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} SUCCESS Index: 0, Name: {46B283A4-4A22-4CED-8FF4-7814CAC68E3C} 13:39:13,8950902 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NO MORE ENTRIES Index: 1, Length: 288 13:39:13,8951039 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} SUCCESS 13:39:13,8951130 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 10, Name: {F3BA9074-6C7E-11D4-97FA-0080C882687E} 13:39:13,8951245 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA-0080C882687E}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8951533 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 11, Name: {F89E9E58-BD2F-4008-9AC2-0F816C09F4EE} 13:39:13,8951626 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{B95F181B-EA4C-4AF1-8056-7C321ABBB091} NAME NOT FOUND Desired Access: Read 13:39:13,8951881 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP NO MORE ENTRIES Index: 12, Length: 288 13:39:13,8952001 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,8953247 SexyCity.exe 564 RegOpenKey HKCU\Keyboard Layout\Toggle SUCCESS Desired Access: Read 13:39:13,8953500 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,8953593 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,8953667 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,8953738 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,8953860 SexyCity.exe 564 RegCloseKey HKCU\Keyboard Layout\Toggle SUCCESS 13:39:13,8954632 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,8954870 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,8954972 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,8955156 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,8955398 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,8955489 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,8955783 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,8955995 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,8956083 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,8956245 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,8956341 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,8956440 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,8956642 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,8956944 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,8957044 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,8957235 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,8957336 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,8957424 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,8957699 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,8957925 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,8958013 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,8958179 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,8958275 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,8958360 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,8958631 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,8958845 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,8958931 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,8959099 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,8959195 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,8959283 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,8959546 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF\LangBarAddIn NAME NOT FOUND Desired Access: Read 13:39:13,8959663 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\LangBarAddIn NAME NOT FOUND Desired Access: Read 13:39:13,8960636 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,8960882 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,8960993 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8961116 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 1, Name: {531FDEBF-9B4C-4A43-A2AA-960E8FCDC732} 13:39:13,8961207 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8961329 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 2, Name: {70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC} 13:39:13,8961418 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8961533 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 3, Name: {766A2C14-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8961619 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8961743 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 4, Name: {766A2C15-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8961925 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8962076 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 5, Name: {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80} 13:39:13,8962181 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} SUCCESS Desired Access: Read 13:39:13,8962523 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} SUCCESS Index: 0, Name: {246ECB87-C2F2-4ABE-905B-C8B38ADD2C43} 13:39:13,8962640 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} SUCCESS Index: 1, Name: {34745C63-B2F0-4784-8B67-5E12C8701A31} 13:39:13,8962741 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} SUCCESS Index: 2, Name: {5130A009-5540-4FCF-97EB-AAD33FC0EE09} 13:39:13,8962848 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} SUCCESS Index: 3, Name: {7AE86BB7-262C-431E-9111-C974B6B7CAC3} 13:39:13,8962949 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} SUCCESS Index: 4, Name: {B5A73CD1-8355-426B-A161-259808F26B14} 13:39:13,8963052 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} SUCCESS Index: 5, Name: {C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} 13:39:13,8963154 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NO MORE ENTRIES Index: 6, Length: 288 13:39:13,8963291 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} SUCCESS 13:39:13,8963381 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 6, Name: {86757E61-EA9E-11D3-9590-0000E843503E} 13:39:13,8963477 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{86757E61-EA9E-11D3-9590-0000E843503E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8963598 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 7, Name: {B3209488-CB34-4017-8E13-10CFCA2519FE} 13:39:13,8963689 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{B3209488-CB34-4017-8E13-10CFCA2519FE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8963811 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 8, Name: {C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82} 13:39:13,8963898 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8964020 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 9, Name: {DCBD6FA8-032F-11D3-B5B1-00C04FC324A1} 13:39:13,8964108 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8964287 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 10, Name: {F3BA9074-6C7E-11D4-97FA-0080C882687E} 13:39:13,8964384 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{F3BA9074-6C7E-11D4-97FA-0080C882687E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8964570 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 11, Name: {F89E9E58-BD2F-4008-9AC2-0F816C09F4EE} 13:39:13,8964761 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90} NAME NOT FOUND Desired Access: Read 13:39:13,8964891 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP NO MORE ENTRIES Index: 12, Length: 288 13:39:13,8965090 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,8966529 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,8966778 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,8966885 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,8967011 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 1, Name: {531FDEBF-9B4C-4A43-A2AA-960E8FCDC732} 13:39:13,8967103 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,8967235 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 2, Name: {70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC} 13:39:13,8967322 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,8967452 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 3, Name: {766A2C14-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8967541 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,8967663 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 4, Name: {766A2C15-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8967750 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,8967873 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 5, Name: {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80} 13:39:13,8967961 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} SUCCESS Desired Access: Read 13:39:13,8968261 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}\Description SUCCESS Type: REG_SZ, Length: 16, Data: Épreuve 13:39:13,8969224 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} SUCCESS 13:39:13,8969339 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,8969536 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,8969771 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,8969872 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,8969995 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 1, Name: {531FDEBF-9B4C-4A43-A2AA-960E8FCDC732} 13:39:13,8970083 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,8970206 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 2, Name: {70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC} 13:39:13,8970296 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,8970412 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 3, Name: {766A2C14-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8970502 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,8970620 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 4, Name: {766A2C15-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8970711 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,8970829 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 5, Name: {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80} 13:39:13,8970917 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} SUCCESS Desired Access: Read 13:39:13,8971198 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}\Description SUCCESS Type: REG_SZ, Length: 28, Data: Balise active 13:39:13,8971361 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} SUCCESS 13:39:13,8971469 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,8971887 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,8972121 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,8972229 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,8972350 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 1, Name: {531FDEBF-9B4C-4A43-A2AA-960E8FCDC732} 13:39:13,8972442 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,8972571 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 2, Name: {70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC} 13:39:13,8972666 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,8972783 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 3, Name: {766A2C14-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8972879 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,8972990 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 4, Name: {766A2C15-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,8973081 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,8973198 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 5, Name: {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80} 13:39:13,8973289 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} SUCCESS Desired Access: Read 13:39:13,8973565 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}\Description SUCCESS Type: REG_SZ, Length: 20, Data: Référence 13:39:13,8973725 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} SUCCESS 13:39:13,8973835 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,8975547 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Nls\Locale SUCCESS Desired Access: Read 13:39:13,8975925 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts SUCCESS Desired Access: Read 13:39:13,8976205 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Nls\Language Groups SUCCESS Desired Access: Read 13:39:13,8976555 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\Nls\Locale\0000040C SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,8976681 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Control\Nls\Language Groups\1 SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,8977704 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink SUCCESS Desired Access: Query Value, Enumerate Sub Keys 13:39:13,8978119 SexyCity.exe 564 RegQueryKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink SUCCESS Query: Cached, SubKeys: 0, Values: 4 13:39:13,8978247 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink SUCCESS Index: 0, Name: Lucida Sans Unicode, Type: REG_MULTI_SZ, Length: 54, Data: MSGOTHIC.TTC,MS UI Gothic 13:39:13,8978545 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink SUCCESS Index: 1, Name: MS UI Gothic, Type: REG_MULTI_SZ, Length: 112, Data: SimSun.TTC,SimSun, gulim.ttc,gulim, mingliu.ttc,PMingLiU 13:39:13,8978766 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink SUCCESS Index: 2, Name: Tahoma, Type: REG_MULTI_SZ, Length: 164, Data: MSGOTHIC.TTC,MS UI Gothic, SimSun.TTC,SimSun, gulim.ttc,gulim, mingliu.ttc,PMingLiU 13:39:13,8978964 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink BUFFER OVERFLOW Index: 3, Length: 220 13:39:13,8979049 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink SUCCESS Index: 3, Name: Microsoft Sans Serif, Type: REG_MULTI_SZ, Length: 164, Data: MSGOTHIC.TTC,MS UI Gothic, SimSun.TTC,SimSun, gulim.ttc,gulim, mingliu.ttc,PMingLiU 13:39:13,8979220 SexyCity.exe 564 RegEnumValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink NO MORE ENTRIES Index: 4, Length: 220 13:39:13,8979340 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink SUCCESS 13:39:13,9001879 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback NAME NOT FOUND Desired Access: Query Value, Enumerate Sub Keys 13:39:13,9003757 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,9004252 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,9004355 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,9004572 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,9004702 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,9004793 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9005017 SexyCity.exe 564 RegOpenKey HKCU\Keyboard Layout\Toggle SUCCESS Desired Access: Read 13:39:13,9005249 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,9005335 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,9005410 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,9005480 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,9005612 SexyCity.exe 564 RegCloseKey HKCU\Keyboard Layout\Toggle SUCCESS 13:39:13,9016215 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll NAME NOT FOUND 13:39:13,9017380 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll NAME NOT FOUND 13:39:13,9017742 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots NAME NOT FOUND Desired Access: Enumerate Sub Keys 13:39:13,9018357 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe.Local NAME NOT FOUND 13:39:13,9019610 SexyCity.exe 564 QueryOpen C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88 SUCCESS CreationTime: 10/09/2008 09:19:44, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 10/09/2008 09:19:44, ChangeTime: 10/09/2008 09:19:44, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,9020849 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88 SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9022512 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9023573 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS AllocationSize: 1 724 416, EndOfFile: 1 724 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9024675 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9025728 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS 13:39:13,9027102 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9028173 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,9028259 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS AllocationSize: 1 724 416, EndOfFile: 1 724 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9028403 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS SyncType: SyncTypeOther 13:39:13,9029456 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS 13:39:13,9031652 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9032683 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS AllocationSize: 1 724 416, EndOfFile: 1 724 416, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9033718 SexyCity.exe 564 FileSystemControl C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9035167 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS 13:39:13,9036558 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9037610 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,9037961 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS SyncType: SyncTypeOther 13:39:13,9039032 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS 13:39:13,9056814 SexyCity.exe 564 Load Image C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll SUCCESS Image Base: 0x4eb80000, Image Size: 0x1a6000 13:39:13,9058617 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gdiplus.dll NAME NOT FOUND Desired Access: Read 13:39:13,9060654 SexyCity.exe 564 RegOpenKey HKLM\Hardware\DeviceMap\VIDEO SUCCESS Desired Access: Read, Maximum Allowed 13:39:13,9060995 SexyCity.exe 564 RegQueryValue HKLM\HARDWARE\DEVICEMAP\VIDEO\MaxObjectNumber SUCCESS Type: REG_DWORD, Length: 4, Data: 4 13:39:13,9061105 SexyCity.exe 564 RegCloseKey HKLM\HARDWARE\DEVICEMAP\VIDEO SUCCESS 13:39:13,9061204 SexyCity.exe 564 RegOpenKey HKLM\SYSTEM\CURRENTCONTROLSET\ENUM SUCCESS Desired Access: Read 13:39:13,9061525 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS Desired Access: Read 13:39:13,9061782 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum SUCCESS 13:39:13,9061892 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID BUFFER OVERFLOW Length: 48 13:39:13,9061984 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID SUCCESS Type: REG_MULTI_SZ, Length: 292, Data: PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1, PCI\VEN_10DE&DEV_0402&SUBSYS_10201462, PCI\VEN_10DE&DEV_0402&CC_030000, PCI\VEN_10DE&DEV_0402&CC_0300 13:39:13,9062085 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS 13:39:13,9062145 SexyCity.exe 564 RegOpenKey HKLM\SYSTEM\CURRENTCONTROLSET\ENUM SUCCESS Desired Access: Read 13:39:13,9062398 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS Desired Access: Read 13:39:13,9062632 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum SUCCESS 13:39:13,9062796 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID BUFFER OVERFLOW Length: 48 13:39:13,9062875 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID SUCCESS Type: REG_MULTI_SZ, Length: 292, Data: PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1, PCI\VEN_10DE&DEV_0402&SUBSYS_10201462, PCI\VEN_10DE&DEV_0402&CC_030000, PCI\VEN_10DE&DEV_0402&CC_0300 13:39:13,9062972 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS 13:39:13,9063041 SexyCity.exe 564 RegOpenKey HKLM\Hardware\DeviceMap\Video SUCCESS Desired Access: Read 13:39:13,9063230 SexyCity.exe 564 RegQueryValue HKLM\HARDWARE\DEVICEMAP\VIDEO\\Device\Video0 SUCCESS Type: REG_SZ, Length: 202, Data: \Registry\Machine\System\CurrentControlSet\Control\Video\{5246EC6E-3E7F-4DE3-A379-B940A787A8DC}\0000 13:39:13,9063316 SexyCity.exe 564 RegCloseKey HKLM\HARDWARE\DEVICEMAP\VIDEO SUCCESS 13:39:13,9064009 SexyCity.exe 564 RegOpenKey HKLM\Hardware\DeviceMap\VIDEO SUCCESS Desired Access: Read, Maximum Allowed 13:39:13,9064227 SexyCity.exe 564 RegQueryValue HKLM\HARDWARE\DEVICEMAP\VIDEO\MaxObjectNumber SUCCESS Type: REG_DWORD, Length: 4, Data: 4 13:39:13,9064306 SexyCity.exe 564 RegCloseKey HKLM\HARDWARE\DEVICEMAP\VIDEO SUCCESS 13:39:13,9064372 SexyCity.exe 564 RegOpenKey HKLM\SYSTEM\CURRENTCONTROLSET\ENUM SUCCESS Desired Access: Read 13:39:13,9064625 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS Desired Access: Read 13:39:13,9064860 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum SUCCESS 13:39:13,9064955 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID BUFFER OVERFLOW Length: 48 13:39:13,9065037 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID SUCCESS Type: REG_MULTI_SZ, Length: 292, Data: PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1, PCI\VEN_10DE&DEV_0402&SUBSYS_10201462, PCI\VEN_10DE&DEV_0402&CC_030000, PCI\VEN_10DE&DEV_0402&CC_0300 13:39:13,9065136 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS 13:39:13,9065195 SexyCity.exe 564 RegOpenKey HKLM\SYSTEM\CURRENTCONTROLSET\ENUM SUCCESS Desired Access: Read 13:39:13,9065439 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS Desired Access: Read 13:39:13,9065690 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum SUCCESS 13:39:13,9065783 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID BUFFER OVERFLOW Length: 48 13:39:13,9065863 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID SUCCESS Type: REG_MULTI_SZ, Length: 292, Data: PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1, PCI\VEN_10DE&DEV_0402&SUBSYS_10201462, PCI\VEN_10DE&DEV_0402&CC_030000, PCI\VEN_10DE&DEV_0402&CC_0300 13:39:13,9065960 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS 13:39:13,9066389 SexyCity.exe 564 RegOpenKey HKLM\Hardware\DeviceMap\Video SUCCESS Desired Access: Read 13:39:13,9066649 SexyCity.exe 564 RegQueryValue HKLM\HARDWARE\DEVICEMAP\VIDEO\\Device\Video0 SUCCESS Type: REG_SZ, Length: 202, Data: \Registry\Machine\System\CurrentControlSet\Control\Video\{5246EC6E-3E7F-4DE3-A379-B940A787A8DC}\0000 13:39:13,9066745 SexyCity.exe 564 RegCloseKey HKLM\HARDWARE\DEVICEMAP\VIDEO SUCCESS 13:39:13,9066852 SexyCity.exe 564 RegOpenKey HKLM\Hardware\DeviceMap\VIDEO SUCCESS Desired Access: Read, Maximum Allowed 13:39:13,9067128 SexyCity.exe 564 RegQueryValue HKLM\HARDWARE\DEVICEMAP\VIDEO\MaxObjectNumber SUCCESS Type: REG_DWORD, Length: 4, Data: 4 13:39:13,9067207 SexyCity.exe 564 RegCloseKey HKLM\HARDWARE\DEVICEMAP\VIDEO SUCCESS 13:39:13,9067280 SexyCity.exe 564 RegOpenKey HKLM\SYSTEM\CURRENTCONTROLSET\ENUM SUCCESS Desired Access: Read 13:39:13,9067654 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS Desired Access: Read 13:39:13,9067925 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum SUCCESS 13:39:13,9068019 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID BUFFER OVERFLOW Length: 48 13:39:13,9068101 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID SUCCESS Type: REG_MULTI_SZ, Length: 292, Data: PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1, PCI\VEN_10DE&DEV_0402&SUBSYS_10201462, PCI\VEN_10DE&DEV_0402&CC_030000, PCI\VEN_10DE&DEV_0402&CC_0300 13:39:13,9068199 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS 13:39:13,9068261 SexyCity.exe 564 RegOpenKey HKLM\SYSTEM\CURRENTCONTROLSET\ENUM SUCCESS Desired Access: Read 13:39:13,9068569 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS Desired Access: Read 13:39:13,9068934 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum SUCCESS 13:39:13,9069039 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID BUFFER OVERFLOW Length: 48 13:39:13,9069126 SexyCity.exe 564 RegQueryValue HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010\HardwareID SUCCESS Type: REG_MULTI_SZ, Length: 292, Data: PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1, PCI\VEN_10DE&DEV_0402&SUBSYS_10201462, PCI\VEN_10DE&DEV_0402&CC_030000, PCI\VEN_10DE&DEV_0402&CC_0300 13:39:13,9069229 SexyCity.exe 564 RegCloseKey HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&DEV_0402&SUBSYS_10201462&REV_A1\4&25eb80e7&0&0010 SUCCESS 13:39:13,9069296 SexyCity.exe 564 RegOpenKey HKLM\Hardware\DeviceMap\Video SUCCESS Desired Access: Read 13:39:13,9069489 SexyCity.exe 564 RegQueryValue HKLM\HARDWARE\DEVICEMAP\VIDEO\\Device\Video1 SUCCESS Type: REG_SZ, Length: 202, Data: \Registry\Machine\System\CurrentControlSet\Control\Video\{5246EC6E-3E7F-4DE3-A379-B940A787A8DC}\0001 13:39:13,9069568 SexyCity.exe 564 RegCloseKey HKLM\HARDWARE\DEVICEMAP\VIDEO SUCCESS 13:39:13,9070678 SexyCity.exe 564 Thread Create SUCCESS Thread ID: 3752 13:39:13,9071987 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts SUCCESS Desired Access: Query Value 13:39:13,9072381 SexyCity.exe 564 RegQueryKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts SUCCESS Query: Cached, SubKeys: 0, Values: 494 13:39:13,9072617 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts SUCCESS 13:39:13,9072751 SexyCity.exe 564 RegCreateKey HKCU\Software\Microsoft\GDIPlus SUCCESS Desired Access: All Access 13:39:13,9073238 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\GDIPlus\FontCachePath SUCCESS Type: REG_SZ, Length: 130, Data: C:\Documents and Settings\DAMIEN\Local Settings\Application Data 13:39:13,9074588 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9075195 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS AllocationSize: 98 304, EndOfFile: 97 392, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9075701 SexyCity.exe 564 FileSystemControl C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9076253 SexyCity.exe 564 QueryBasicInformationFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS CreationTime: 11/06/2007 16:13:01, LastAccessTime: 15/02/2011 14:24:13, LastWriteTime: 15/02/2011 14:24:13, ChangeTime: 15/02/2011 14:24:13, FileAttributes: A 13:39:13,9076811 SexyCity.exe 564 ReadFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Offset: 0, Length: 1 024 13:39:13,9078272 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS 13:39:13,9079725 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS Desired Access: Generic Read/Write, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9080332 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF SUCCESS Desired Access: Maximum Allowed 13:39:13,9080634 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\CTF\Disable Thread Input Manager SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9080795 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\CTF SUCCESS 13:39:13,9081178 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\CTF\SystemShared SUCCESS Desired Access: Maximum Allowed 13:39:13,9081463 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\SystemShared\CUAS SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,9081587 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\SystemShared SUCCESS 13:39:13,9081846 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF SUCCESS Desired Access: Maximum Allowed 13:39:13,9082212 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\GDIPlus SUCCESS 13:39:13,9082282 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\CTF\Disable Thread Input Manager SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9082468 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\CTF SUCCESS 13:39:13,9082552 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,9082791 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,9082851 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS AllocationSize: 98 304, EndOfFile: 97 392, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9082916 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS Desired Access: Read 13:39:13,9083219 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS 13:39:13,9083266 SexyCity.exe 564 CreateFileMapping C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE 13:39:13,9083328 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile NAME NOT FOUND Desired Access: Read 13:39:13,9083473 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS Desired Access: Read 13:39:13,9083719 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS Index: 0, Name: 0x00000000 13:39:13,9083798 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000 SUCCESS Desired Access: Read 13:39:13,9084065 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000 SUCCESS Index: 0, Name: {63800dac-e7ca-4df9-9a5c-20765055488d} 13:39:13,9084141 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} SUCCESS Desired Access: Read 13:39:13,9084465 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}\Enable NAME NOT FOUND Length: 144 13:39:13,9084624 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} SUCCESS 13:39:13,9084745 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000 SUCCESS 13:39:13,9084862 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile SUCCESS 13:39:13,9084971 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,9085567 SexyCity.exe 564 QueryStandardInformationFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS AllocationSize: 98 304, EndOfFile: 97 392, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9085703 SexyCity.exe 564 CreateFileMapping C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS SyncType: SyncTypeOther 13:39:13,9091897 SexyCity.exe 564 RegOpenKey HKCU\Keyboard Layout\Toggle SUCCESS Desired Access: Read 13:39:13,9092188 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,9092284 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,9092361 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,9092432 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,9092477 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT SUCCESS 13:39:13,9092570 SexyCity.exe 564 RegCloseKey HKCU\Keyboard Layout\Toggle SUCCESS 13:39:13,9094993 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9096121 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,9096203 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9096402 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,9096515 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,9096721 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,9096879 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,9096980 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9097231 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,9097243 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9097466 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,9097557 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,9097738 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,9097839 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,9097935 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9098140 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,9098365 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS 13:39:13,9098373 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,9098465 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,9098648 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,9098750 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,9100127 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9101359 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9101859 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9103161 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:10:10, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:40:30, FileAttributes: A 13:39:13,9104310 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS 13:39:13,9105988 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,9106038 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9106258 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,9106353 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,9106543 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,9106649 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,9106743 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9107010 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,9107133 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9107243 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,9107335 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,9107512 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,9107613 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,9107709 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9107996 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF\LangBarAddIn NAME NOT FOUND Desired Access: Read 13:39:13,9108118 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\LangBarAddIn NAME NOT FOUND Desired Access: Read 13:39:13,9108162 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9109818 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,9109879 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS 13:39:13,9110142 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,9110290 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,9110437 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 1, Name: {531FDEBF-9B4C-4A43-A2AA-960E8FCDC732} 13:39:13,9110537 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,9110678 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 2, Name: {70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC} 13:39:13,9110768 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,9110896 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 3, Name: {766A2C14-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,9110989 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,9111118 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 4, Name: {766A2C15-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,9111210 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} NAME NOT FOUND Desired Access: Read 13:39:13,9111296 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9111415 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 5, Name: {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80} 13:39:13,9111566 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} SUCCESS Desired Access: Read 13:39:13,9111904 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09}\Description SUCCESS Type: REG_SZ, Length: 16, Data: Épreuve 13:39:13,9112130 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{5130A009-5540-4FCF-97EB-AAD33FC0EE09} SUCCESS 13:39:13,9112240 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,9112427 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,9112658 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,9112769 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,9112895 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 1, Name: {531FDEBF-9B4C-4A43-A2AA-960E8FCDC732} 13:39:13,9112984 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,9113099 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 2, Name: {70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC} 13:39:13,9113186 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,9113297 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 3, Name: {766A2C14-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,9113384 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,9113499 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 4, Name: {766A2C15-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,9113583 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} NAME NOT FOUND Desired Access: Read 13:39:13,9113701 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 5, Name: {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80} 13:39:13,9113785 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} SUCCESS Desired Access: Read 13:39:13,9114132 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3}\Description SUCCESS Type: REG_SZ, Length: 28, Data: Balise active 13:39:13,9114286 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{7AE86BB7-262C-431E-9111-C974B6B7CAC3} SUCCESS 13:39:13,9114392 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,9114764 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Desired Access: Read 13:39:13,9114991 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 0, Name: {1188450c-fdab-47ae-80d8-c9633f71be64} 13:39:13,9115088 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,9115206 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 1, Name: {531FDEBF-9B4C-4A43-A2AA-960E8FCDC732} 13:39:13,9115291 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,9115406 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 2, Name: {70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC} 13:39:13,9115491 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{70FAF614-E0B1-11D3-8F5C-00C04F9CF4AC}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,9115601 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 3, Name: {766A2C14-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,9115685 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C14-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,9115798 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 4, Name: {766A2C15-B226-4FD6-B52A-867B3EBF38D2} 13:39:13,9115882 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{766A2C15-B226-4FD6-B52A-867B3EBF38D2}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} NAME NOT FOUND Desired Access: Read 13:39:13,9115995 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS Index: 5, Name: {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80} 13:39:13,9116079 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} SUCCESS Desired Access: Read 13:39:13,9116358 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04}\Description SUCCESS Type: REG_SZ, Length: 20, Data: Référence 13:39:13,9116519 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\{C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} SUCCESS 13:39:13,9116637 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\TIP SUCCESS 13:39:13,9117813 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:10:10, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:40:30, FileAttributes: A 13:39:13,9118785 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9119933 SexyCity.exe 564 RegOpenKey HKCU\Keyboard Layout\Toggle SUCCESS Desired Access: Read 13:39:13,9120065 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahoma.ttf SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,9120150 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9120210 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,9120291 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahoma.ttf SUCCESS SyncType: SyncTypeOther 13:39:13,9120301 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 1 13:39:13,9120395 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,9120477 SexyCity.exe 564 RegQueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS Type: REG_SZ, Length: 4, Data: 2 13:39:13,9120615 SexyCity.exe 564 RegCloseKey HKCU\Keyboard Layout\Toggle SUCCESS 13:39:13,9121726 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS 13:39:13,9125094 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9126102 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9127062 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9128142 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS 13:39:13,9129472 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9132235 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:10:10, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:40:30, FileAttributes: A 13:39:13,9133182 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9134127 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahoma.ttf SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,9134202 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS AllocationSize: 385 024, EndOfFile: 383 140, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9134326 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahoma.ttf SUCCESS SyncType: SyncTypeOther 13:39:13,9135423 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahoma.ttf SUCCESS 13:39:13,9138881 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9139912 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9140869 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9141883 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS 13:39:13,9143213 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9144229 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9145150 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:38:21, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:39:14, FileAttributes: A 13:39:13,9146109 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS 13:39:13,9147743 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9148748 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9149703 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9150699 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS 13:39:13,9152028 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9153068 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:38:21, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:39:14, FileAttributes: A 13:39:13,9154005 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9154963 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,9155200 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9155331 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS SyncType: SyncTypeOther 13:39:13,9156844 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS 13:39:13,9159091 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9160125 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9161105 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9162117 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS 13:39:13,9163748 SexyCity.exe 564 CreateFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9164779 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:38:21, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:39:14, FileAttributes: A 13:39:13,9165692 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9166628 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,9166699 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS AllocationSize: 356 352, EndOfFile: 355 436, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9166820 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS SyncType: SyncTypeOther 13:39:13,9167912 SexyCity.exe 564 CloseFile C:\WINDOWS\Fonts\tahomabd.ttf SUCCESS 13:39:13,9201093 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9202954 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,9206539 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS CreationTime: 25/07/2008 10:17:02, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:02, ChangeTime: 15/02/2011 20:25:42, AllocationSize: 28 672, EndOfFile: 27 136, FileAttributes: A 13:39:13,9207830 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9208605 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS AllocationSize: 28 672, EndOfFile: 27 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9209326 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9210128 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS 13:39:13,9211389 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9212324 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,9212407 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS AllocationSize: 28 672, EndOfFile: 27 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9212542 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeOther 13:39:13,9213606 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS 13:39:13,9215302 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS CreationTime: 25/07/2008 10:17:02, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:02, ChangeTime: 15/02/2011 20:25:42, AllocationSize: 28 672, EndOfFile: 27 136, FileAttributes: A 13:39:13,9216410 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS CreationTime: 25/07/2008 10:17:02, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:02, ChangeTime: 15/02/2011 20:25:42, AllocationSize: 28 672, EndOfFile: 27 136, FileAttributes: A 13:39:13,9217695 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9218457 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS AllocationSize: 28 672, EndOfFile: 27 136, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9219397 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9220166 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS 13:39:13,9221256 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9222027 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,9222307 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS SyncType: SyncTypeOther 13:39:13,9223102 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS 13:39:13,9247012 SexyCity.exe 564 Load Image C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll SUCCESS Image Base: 0x60340000, Image Size: 0x8000 13:39:13,9247309 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,9247721 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,9247846 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,9248049 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,9248290 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,9248389 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9249517 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9250543 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9251618 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll.2.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9252413 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll.2.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9328337 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots NAME NOT FOUND Desired Access: Enumerate Sub Keys 13:39:13,9329023 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe.Local NAME NOT FOUND 13:39:13,9330222 SexyCity.exe 564 QueryOpen C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS CreationTime: 21/05/2010 14:49:41, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 21/05/2010 14:49:41, ChangeTime: 21/05/2010 14:49:41, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,9331374 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9332424 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\culture.dll NAME NOT FOUND Desired Access: Read 13:39:13,9333896 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS 13:39:13,9334836 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr-FR\mscorrc.dll PATH NOT FOUND 13:39:13,9335295 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr-FR\mscorrc.dll PATH NOT FOUND 13:39:13,9335688 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr-FR\mscorrc.dll.DLL PATH NOT FOUND 13:39:13,9337167 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS CreationTime: 26/07/2008 01:56:48, LastAccessTime: 17/02/2011 11:07:51, LastWriteTime: 26/07/2008 01:56:48, ChangeTime: 16/02/2011 10:27:22, AllocationSize: 421 888, EndOfFile: 420 864, FileAttributes: A 13:39:13,9338695 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9339730 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS AllocationSize: 421 888, EndOfFile: 420 864, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9340704 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9341757 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS 13:39:13,9343489 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9344888 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,9344979 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS AllocationSize: 421 888, EndOfFile: 420 864, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9345116 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS SyncType: SyncTypeOther 13:39:13,9346430 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS 13:39:13,9349483 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS CreationTime: 26/07/2008 01:56:48, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 26/07/2008 01:56:48, ChangeTime: 16/02/2011 10:27:22, AllocationSize: 421 888, EndOfFile: 420 864, FileAttributes: A 13:39:13,9351346 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9352663 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS AllocationSize: 421 888, EndOfFile: 420 864, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9353655 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9354677 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS 13:39:13,9356088 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9357123 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,9357193 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS AllocationSize: 421 888, EndOfFile: 420 864, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9357385 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS SyncType: SyncTypeOther 13:39:13,9358660 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS 13:39:13,9369623 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,9369729 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 NAME NOT FOUND Desired Access: Read 13:39:13,9369957 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 SUCCESS Desired Access: Read 13:39:13,9370715 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 SUCCESS Query: Name 13:39:13,9370894 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,9371063 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default) SUCCESS Type: REG_SZ, Length: 24, Data: mscoree.dll 13:39:13,9371182 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 SUCCESS Query: Name 13:39:13,9371317 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,9371463 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default) SUCCESS Type: REG_SZ, Length: 24, Data: mscoree.dll 13:39:13,9371607 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 SUCCESS 13:39:13,9372037 SexyCity.exe 564 RegQueryKey HKCU\Software\Classes SUCCESS Query: Name 13:39:13,9372137 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server NAME NOT FOUND Desired Access: Read 13:39:13,9372238 SexyCity.exe 564 RegOpenKey HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server SUCCESS Desired Access: Read 13:39:13,9372551 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server SUCCESS Query: Name 13:39:13,9372810 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,9372987 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default) SUCCESS Type: REG_SZ, Length: 34, Data: diasymreader.dll 13:39:13,9373095 SexyCity.exe 564 RegQueryKey HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server SUCCESS Query: Name 13:39:13,9373233 SexyCity.exe 564 RegOpenKey HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server NAME NOT FOUND Desired Access: Maximum Allowed 13:39:13,9373389 SexyCity.exe 564 RegQueryValue HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default) SUCCESS Type: REG_SZ, Length: 34, Data: diasymreader.dll 13:39:13,9373635 SexyCity.exe 564 RegCloseKey HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server SUCCESS 13:39:13,9374727 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS CreationTime: 25/07/2008 10:17:16, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:16, ChangeTime: 15/02/2011 20:25:42, AllocationSize: 577 536, EndOfFile: 575 496, FileAttributes: A 13:39:13,9375890 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9376406 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS AllocationSize: 577 536, EndOfFile: 575 496, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9376841 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9377346 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS 13:39:13,9378164 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9378665 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,9378743 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS AllocationSize: 577 536, EndOfFile: 575 496, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9378871 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeOther 13:39:13,9379368 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS 13:39:13,9380487 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS CreationTime: 25/07/2008 10:17:16, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:16, ChangeTime: 15/02/2011 20:25:42, AllocationSize: 577 536, EndOfFile: 575 496, FileAttributes: A 13:39:13,9381283 SexyCity.exe 564 QueryOpen C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS CreationTime: 25/07/2008 10:17:16, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 25/07/2008 10:17:16, ChangeTime: 15/02/2011 20:25:42, AllocationSize: 577 536, EndOfFile: 575 496, FileAttributes: A 13:39:13,9382230 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9382713 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS AllocationSize: 577 536, EndOfFile: 575 496, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9383141 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9383615 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS 13:39:13,9384416 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9384971 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,9385244 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS SyncType: SyncTypeOther 13:39:13,9385755 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS 13:39:13,9408900 SexyCity.exe 564 Load Image C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Image Base: 0x5e3a0000, Image Size: 0x8d000 13:39:13,9409300 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Maximum Allowed 13:39:13,9409656 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND Desired Access: Read 13:39:13,9409772 SexyCity.exe 564 RegOpenKey HKCU\Control Panel\Desktop SUCCESS Desired Access: Read 13:39:13,9409968 SexyCity.exe 564 RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND Length: 256 13:39:13,9410681 SexyCity.exe 564 RegCloseKey HKCU\Control Panel\Desktop SUCCESS 13:39:13,9410781 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9411922 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9412912 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll.2.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9414006 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll.2.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9415031 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll.2.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9489029 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots NAME NOT FOUND Desired Access: Enumerate Sub Keys 13:39:13,9489654 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe.Local NAME NOT FOUND 13:39:13,9490829 SexyCity.exe 564 QueryOpen C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS CreationTime: 21/05/2010 14:49:41, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 21/05/2010 14:49:41, ChangeTime: 21/05/2010 14:49:41, AllocationSize: 0, EndOfFile: 0, FileAttributes: D 13:39:13,9491964 SexyCity.exe 564 CreateFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9493700 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diasymreader.dll NAME NOT FOUND Desired Access: Read 13:39:13,9498574 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9500396 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Offset: 0, Length: 4 096 13:39:13,9502734 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Offset: 128, Length: 512 13:39:13,9504513 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Offset: 376, Length: 512 13:39:13,9506259 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Offset: 3 992 188, Length: 512 13:39:13,9507899 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS Offset: 3 992 216, Length: 512 13:39:13,9510201 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9512109 SexyCity.exe 564 CreateFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,9513268 SexyCity.exe 564 CreateFile C:\WINDOWS\symbols\dll\mscorlib.pdb PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9513623 SexyCity.exe 564 CreateFile C:\WINDOWS\symbols\dll\mscorlib.pdb PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,9514280 SexyCity.exe 564 CreateFile C:\WINDOWS\dll\mscorlib.pdb PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9514613 SexyCity.exe 564 CreateFile C:\WINDOWS\dll\mscorlib.pdb PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,9515930 SexyCity.exe 564 CreateFile C:\WINDOWS\mscorlib.pdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9516950 SexyCity.exe 564 CreateFile C:\WINDOWS\mscorlib.pdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a 13:39:13,9518621 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll SUCCESS 13:39:13,9532555 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND Desired Access: Read 13:39:13,9532713 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND Desired Access: Read 13:39:13,9532828 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS Desired Access: Read 13:39:13,9533417 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\PCHealth\ErrorReporting\ForceQueueMode NAME NOT FOUND Length: 144 13:39:13,9533563 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\PCHealth\ErrorReporting SUCCESS 13:39:13,9533651 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS Desired Access: Read 13:39:13,9534015 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ForceQueueMode NAME NOT FOUND Length: 144 13:39:13,9534155 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS 13:39:13,9534240 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND Desired Access: Read 13:39:13,9534330 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND Desired Access: Read 13:39:13,9534419 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS Desired Access: Read 13:39:13,9534640 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\PCHealth\ErrorReporting\ShowUI NAME NOT FOUND Length: 144 13:39:13,9534751 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\PCHealth\ErrorReporting SUCCESS 13:39:13,9534814 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS Desired Access: Read 13:39:13,9535027 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ShowUI SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,9535146 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS 13:39:13,9535216 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND Desired Access: Read 13:39:13,9535305 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND Desired Access: Read 13:39:13,9535393 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS Desired Access: Read 13:39:13,9535723 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\PCHealth\ErrorReporting\DoReport NAME NOT FOUND Length: 144 13:39:13,9535833 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\PCHealth\ErrorReporting SUCCESS 13:39:13,9535895 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS Desired Access: Read 13:39:13,9536100 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DoReport SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,9536215 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS 13:39:13,9536282 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND Desired Access: Read 13:39:13,9536368 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND Desired Access: Read 13:39:13,9536455 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS Desired Access: Read 13:39:13,9536752 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\PCHealth\ErrorReporting\AllOrNone NAME NOT FOUND Length: 144 13:39:13,9536869 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\PCHealth\ErrorReporting SUCCESS 13:39:13,9536934 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS Desired Access: Read 13:39:13,9537155 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\AllOrNone SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,9537441 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS 13:39:13,9537564 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\ExclusionList NAME NOT FOUND Desired Access: Read 13:39:13,9537696 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\ExclusionList NAME NOT FOUND Desired Access: Read 13:39:13,9537805 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList NAME NOT FOUND Desired Access: Read 13:39:13,9537936 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList SUCCESS Desired Access: Read 13:39:13,9538254 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList\SexyCity.exe NAME NOT FOUND Length: 144 13:39:13,9538587 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList SUCCESS 13:39:13,9538677 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\InclusionList NAME NOT FOUND Desired Access: Read 13:39:13,9538802 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\InclusionList NAME NOT FOUND Desired Access: Read 13:39:13,9538904 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList NAME NOT FOUND Desired Access: Read 13:39:13,9538996 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList SUCCESS Desired Access: Read 13:39:13,9539274 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList\SexyCity.exe NAME NOT FOUND Length: 144 13:39:13,9539407 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList SUCCESS 13:39:13,9541479 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,9542470 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,9543458 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,9544288 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,9545357 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,9546145 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,9547007 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,9547787 SexyCity.exe 564 QueryOpen C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS CreationTime: 16/02/2011 09:44:13, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 12/02/2011 21:25:08, ChangeTime: 17/02/2011 13:38:33, AllocationSize: 2 101 248, EndOfFile: 2 097 664, FileAttributes: A 13:39:13,9548690 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\PCHealth\ErrorReporting\DW\Installed SUCCESS Desired Access: Read 13:39:13,9549076 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW\Installed\DW0200 SUCCESS Type: REG_SZ, Length: 84, Data: C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE 13:39:13,9549251 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW\Installed SUCCESS 13:39:13,9637392 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9639817 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS AllocationSize: 819 200, EndOfFile: 816 528, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9641516 SexyCity.exe 564 FileSystemControl C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9643266 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS 13:39:13,9645175 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 13:39:13,9646779 SexyCity.exe 564 CreateFileMapping C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE 13:39:13,9646848 SexyCity.exe 564 QueryStandardInformationFile C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE SUCCESS AllocationSize: 819 200, EndOfFile: 816 528, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9646922 SexyCity.exe 564 CreateFileMapping C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE SUCCESS SyncType: SyncTypeOther 13:39:13,9647037 SexyCity.exe 564 ReadFile C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE SUCCESS Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:13,9733201 SexyCity.exe 564 CreateFileMapping C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS SyncType: SyncTypeOther 13:39:13,9733386 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls NAME NOT FOUND Desired Access: Query Value 13:39:13,9735749 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\apphelp.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:13, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:12, AllocationSize: 126 976, EndOfFile: 126 976, FileAttributes: A 13:39:13,9737543 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9738555 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9739489 SexyCity.exe 564 FileSystemControl C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9740470 SexyCity.exe 564 QueryBasicInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 27/09/2010 09:40:22, LastWriteTime: 04/10/2006 15:06:21, ChangeTime: 25/03/2008 12:05:00, FileAttributes: A 13:39:13,9741469 SexyCity.exe 564 ReadFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Offset: 0, Length: 1 024 13:39:13,9742529 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:13,9743854 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9744843 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9746033 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,9746102 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9746222 SexyCity.exe 564 CreateFileMapping C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS SyncType: SyncTypeOther 13:39:13,9747244 SexyCity.exe 564 QueryStandardInformationFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS AllocationSize: 1 200 128, EndOfFile: 1 197 294, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9748907 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\systest.sdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9750186 SexyCity.exe 564 CreateFile C:\WINDOWS\AppPatch\systest.sdb NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a 13:39:13,9752118 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9753454 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS Filter: DW20.EXE, 1: DW20.EXE 13:39:13,9754828 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs\Microsoft Shared\DW SUCCESS 13:39:13,9757645 SexyCity.exe 564 QueryOpen C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS CreationTime: 26/02/2007 01:01:00, LastAccessTime: 17/02/2011 11:07:52, LastWriteTime: 26/02/2007 01:01:00, ChangeTime: 16/02/2011 11:38:47, AllocationSize: 819 200, EndOfFile: 816 528, FileAttributes: A 13:39:13,9757977 SexyCity.exe 564 CreateFile C:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9758168 SexyCity.exe 564 QueryDirectory C:\PROGRA~1 SUCCESS Filter: PROGRA~1, 1: Program Files 13:39:13,9758428 SexyCity.exe 564 CloseFile C:\ SUCCESS 13:39:13,9759403 SexyCity.exe 564 CreateFile C:\Program Files SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9759899 SexyCity.exe 564 QueryDirectory C:\Program Files\FICHIE~1 SUCCESS Filter: FICHIE~1, 1: Fichiers communs 13:39:13,9760467 SexyCity.exe 564 CloseFile C:\Program Files SUCCESS 13:39:13,9761729 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9762519 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\MICROS~1 SUCCESS Filter: MICROS~1, 1: Microsoft Shared 13:39:13,9763413 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs SUCCESS 13:39:13,9764945 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9766349 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\Microsoft Shared\DW SUCCESS Filter: DW, 1: DW 13:39:13,9767445 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs\Microsoft Shared SUCCESS 13:39:13,9769249 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9770561 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS Filter: DW20.EXE, 1: DW20.EXE 13:39:13,9771902 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs\Microsoft Shared\DW SUCCESS 13:39:13,9772147 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers SUCCESS Desired Access: Read, WOW64_64Key 13:39:13,9772687 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE NAME NOT FOUND Length: 1 024 13:39:13,9772866 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers SUCCESS 13:39:13,9773022 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers NAME NOT FOUND Desired Access: Read, WOW64_64Key 13:39:13,9773145 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\DW20.EXE NAME NOT FOUND Desired Access: Read, WOW64_64Key 13:39:13,9775300 SexyCity.exe 564 CloseFile C:\WINDOWS\AppPatch\sysmain.sdb SUCCESS 13:39:13,9775618 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\SafeBoot\Option NAME NOT FOUND Desired Access: Query Value, Set Value 13:39:13,9775807 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS Desired Access: Query Value 13:39:13,9776094 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:13,9776189 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9776312 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS 13:39:13,9776597 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\LevelObjects NAME NOT FOUND Desired Access: Read 13:39:13,9776721 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS Desired Access: Query Value 13:39:13,9776947 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\Levels NAME NOT FOUND Length: 536 13:39:13,9777066 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS 13:39:13,9777488 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths SUCCESS Desired Access: Read 13:39:13,9777841 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths SUCCESS Index: 0, Name: {dda3f824-d8cb-441b-834d-be2efd2c1a33} 13:39:13,9777961 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} SUCCESS Desired Access: Read 13:39:13,9778309 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\ItemData SUCCESS Type: REG_EXPAND_SZ, Length: 190, Data: %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK* 13:39:13,9778445 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\SaferFlags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9778585 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} SUCCESS 13:39:13,9778937 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths NO MORE ENTRIES Index: 1, Length: 280 13:39:13,9779047 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths SUCCESS 13:39:13,9779105 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes SUCCESS Desired Access: Read 13:39:13,9779402 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes SUCCESS Index: 0, Name: {349d35ab-37b5-462f-9b89-edd5fbde1328} 13:39:13,9779501 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} SUCCESS Desired Access: Read 13:39:13,9779989 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemData SUCCESS Type: REG_BINARY, Length: 16, Data: 5E AB 30 4F 95 7A 49 89 6A 00 6C 1C 31 15 40 15 13:39:13,9780124 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\HashAlg SUCCESS Type: REG_DWORD, Length: 4, Data: 32771 13:39:13,9780220 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ItemSize SUCCESS Type: REG_QWORD, Length: 8, Data: 13:39:13,9780329 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\SaferFlags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9780478 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} SUCCESS 13:39:13,9780583 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes SUCCESS Index: 1, Name: {7fb9cd2e-3076-4df9-a57b-b813f72dbb91} 13:39:13,9780687 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} SUCCESS Desired Access: Read 13:39:13,9781020 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemData SUCCESS Type: REG_BINARY, Length: 16, Data: 67 B0 D4 8B 34 3A 3F D3 BC E9 DC 64 67 04 F3 94 13:39:13,9781209 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\HashAlg SUCCESS Type: REG_DWORD, Length: 4, Data: 32771 13:39:13,9781312 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ItemSize SUCCESS Type: REG_QWORD, Length: 8, Data: 13:39:13,9781425 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\SaferFlags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9781577 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} SUCCESS 13:39:13,9781782 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes SUCCESS Index: 2, Name: {81d1fe15-dd9d-4762-b16d-7c29ddecae3f} 13:39:13,9781896 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} SUCCESS Desired Access: Read 13:39:13,9782249 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemData SUCCESS Type: REG_BINARY, Length: 16, Data: 32 78 02 DC FE F8 C8 93 DC 8A B0 06 DD 84 7D 1D 13:39:13,9782390 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\HashAlg SUCCESS Type: REG_DWORD, Length: 4, Data: 32771 13:39:13,9782488 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ItemSize SUCCESS Type: REG_QWORD, Length: 8, Data: 13:39:13,9782626 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\SaferFlags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9782772 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} SUCCESS 13:39:13,9782876 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes SUCCESS Index: 3, Name: {94e3e076-8f53-42a5-8411-085bcc18a68d} 13:39:13,9782980 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} SUCCESS Desired Access: Read 13:39:13,9783310 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemData SUCCESS Type: REG_BINARY, Length: 16, Data: BD 9A 2A DB 42 EB D8 56 0E 25 0E 4D F8 16 2F 67 13:39:13,9783439 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\HashAlg SUCCESS Type: REG_DWORD, Length: 4, Data: 32771 13:39:13,9783535 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ItemSize SUCCESS Type: REG_QWORD, Length: 8, Data: 13:39:13,9783646 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\SaferFlags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9783790 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} SUCCESS 13:39:13,9783895 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes SUCCESS Index: 4, Name: {dc971ee5-44eb-4fe4-ae2e-b91490411bfc} 13:39:13,9783992 SexyCity.exe 564 RegOpenKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} SUCCESS Desired Access: Read 13:39:13,9784316 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemData SUCCESS Type: REG_BINARY, Length: 16, Data: 38 6B 08 5F 84 EC F6 69 D3 6B 95 6A 22 C0 1E 80 13:39:13,9784450 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\HashAlg SUCCESS Type: REG_DWORD, Length: 4, Data: 32771 13:39:13,9784544 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ItemSize SUCCESS Type: REG_QWORD, Length: 8, Data: 13:39:13,9784651 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\SaferFlags SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9784872 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} SUCCESS 13:39:13,9784973 SexyCity.exe 564 RegEnumKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes NO MORE ENTRIES Index: 5, Length: 280 13:39:13,9785081 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes SUCCESS 13:39:13,9785139 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9785248 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9785420 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9785503 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9785598 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9785676 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9785754 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9785832 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9785915 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9785994 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9786075 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9786313 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9786415 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9786591 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9786772 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9786941 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9787105 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9787272 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9787433 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9787741 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9787931 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9788097 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9788267 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9788441 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9788607 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9788776 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths NAME NOT FOUND Desired Access: Read 13:39:13,9788941 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes NAME NOT FOUND Desired Access: Read 13:39:13,9789107 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones NAME NOT FOUND Desired Access: Read 13:39:13,9789201 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS Desired Access: Read 13:39:13,9789433 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\DefaultLevel SUCCESS Type: REG_DWORD, Length: 4, Data: 262144 13:39:13,9789560 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS 13:39:13,9789706 SexyCity.exe 564 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers NAME NOT FOUND Desired Access: Read 13:39:13,9790147 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS Desired Access: Query Value 13:39:13,9790422 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\PolicyScope SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:13,9790548 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS 13:39:13,9792329 SexyCity.exe 564 QueryNameInformationFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS Name: \PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE 13:39:13,9794254 SexyCity.exe 564 QueryOpen C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS CreationTime: 26/02/2007 01:01:00, LastAccessTime: 17/02/2011 11:07:52, LastWriteTime: 26/02/2007 01:01:00, ChangeTime: 16/02/2011 11:38:47, AllocationSize: 819 200, EndOfFile: 816 528, FileAttributes: A 13:39:13,9794595 SexyCity.exe 564 CreateFile C:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9794791 SexyCity.exe 564 QueryDirectory C:\PROGRA~1 SUCCESS Filter: PROGRA~1, 1: Program Files 13:39:13,9795067 SexyCity.exe 564 CloseFile C:\ SUCCESS 13:39:13,9796269 SexyCity.exe 564 CreateFile C:\Program Files SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9796757 SexyCity.exe 564 QueryDirectory C:\Program Files\FICHIE~1 SUCCESS Filter: FICHIE~1, 1: Fichiers communs 13:39:13,9797314 SexyCity.exe 564 CloseFile C:\Program Files SUCCESS 13:39:13,9798570 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9799353 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\MICROS~1 SUCCESS Filter: MICROS~1, 1: Microsoft Shared 13:39:13,9800173 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs SUCCESS 13:39:13,9801857 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9803033 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\Microsoft Shared\DW SUCCESS Filter: DW, 1: DW 13:39:13,9804151 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs\Microsoft Shared SUCCESS 13:39:13,9806066 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 13:39:13,9807397 SexyCity.exe 564 QueryDirectory C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS Filter: DW20.EXE, 1: DW20.EXE 13:39:13,9808751 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs\Microsoft Shared\DW SUCCESS 13:39:13,9810417 SexyCity.exe 564 QueryStandardInformationFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS AllocationSize: 819 200, EndOfFile: 816 528, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9811899 SexyCity.exe 564 CreateFileMapping C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY 13:39:13,9811968 SexyCity.exe 564 QueryStandardInformationFile C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE SUCCESS AllocationSize: 819 200, EndOfFile: 816 528, NumberOfLinks: 1, DeletePending: False, Directory: False 13:39:13,9813482 SexyCity.exe 564 CreateFileMapping C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS SyncType: SyncTypeOther 13:39:13,9813783 SexyCity.exe 564 RegOpenKey HKCU SUCCESS Desired Access: Read 13:39:13,9814051 SexyCity.exe 564 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders SUCCESS Desired Access: Read 13:39:13,9814352 SexyCity.exe 564 RegCloseKey HKCU SUCCESS 13:39:13,9814476 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache BUFFER OVERFLOW Length: 144 13:39:13,9814680 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache SUCCESS Type: REG_SZ, Length: 146, Data: C:\Documents and Settings\DAMIEN\Local Settings\Temporary Internet Files 13:39:13,9814833 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders SUCCESS 13:39:13,9815035 SexyCity.exe 564 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS Desired Access: Query Value 13:39:13,9815278 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\LogFileName NAME NOT FOUND Length: 536 13:39:13,9815392 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS 13:39:13,9815437 SexyCity.exe 564 RegOpenKey HKLM\System\CurrentControlSet\Control\SafeBoot\Option NAME NOT FOUND Desired Access: Query Value, Set Value 13:39:13,9815661 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE NAME NOT FOUND Desired Access: Read 13:39:13,9817019 SexyCity.exe 564 ReadFile C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE SUCCESS Offset: 144 384, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:13,9823209 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE.Manifest NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9824942 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE.Manifest NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9825333 SexyCity.exe 564 ReadFile C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE SUCCESS Offset: 770 560, Length: 14 336, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:13,9916663 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE.Config NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9918286 SexyCity.exe 564 CreateFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE.Config NAME NOT FOUND Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a 13:39:13,9920801 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\kernel32.dll SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9921864 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\kernel32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9922882 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\kernel32.dll SUCCESS 13:39:13,9924153 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9924935 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9925665 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,9926632 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9927134 SexyCity.exe 564 FileSystemControl C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9927618 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS 13:39:13,9929242 SexyCity.exe 564 CreateFile C:\WINDOWS\system32\kernel32.dll SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9930267 SexyCity.exe 564 FileSystemControl C:\WINDOWS\system32\kernel32.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9931232 SexyCity.exe 564 CloseFile C:\WINDOWS\system32\kernel32.dll SUCCESS 13:39:13,9932546 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9933311 SexyCity.exe 564 FileSystemControl C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9934029 SexyCity.exe 564 CloseFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS 13:39:13,9934946 SexyCity.exe 564 CreateFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened 13:39:13,9935426 SexyCity.exe 564 FileSystemControl C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS Control: FSCTL_READ_FILE_USN_DATA 13:39:13,9935886 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0\SexyCity.exe SUCCESS 13:39:13,9936265 SexyCity.exe 564 Process Create C:\PROGRA~1\FICHIE~1\MICROS~1\DW\DW20.EXE SUCCESS PID: 3292, Command line: dw20.exe -x -s 568 13:39:14,0119133 SexyCity.exe 564 CloseFile C:\Program Files\Fichiers communs\Microsoft Shared\DW\DW20.EXE SUCCESS 13:39:14,1859385 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.1875000 seconds, Private Bytes: 11 595 776, Working Set: 12 746 752 13:39:15,1860351 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 573 568 13:39:16,1858216 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 573 568 13:39:17,1857690 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 573 568 13:39:18,1856910 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 573 568 13:39:19,1856595 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 573 568 13:39:20,1856031 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 573 568 13:39:21,1855492 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 573 568 13:39:22,1855067 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 573 568 13:39:23,1854593 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 577 664 13:39:24,1854094 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 577 664 13:39:25,1853712 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 577 664 13:39:26,1853991 SexyCity.exe 564 Process Profiling SUCCESS User Time: 0.0468750 seconds, Kernel Time: 0.2031250 seconds, Private Bytes: 11 595 776, Working Set: 14 577 664 13:39:26,6411304 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\mscorrc.dll SUCCESS Offset: 135 168, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,6546298 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 8 694 784, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,6637367 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 6 794 240, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,6784913 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 9 137 152, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,6957348 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 2 024 448, Length: 16 384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,7051574 SexyCity.exe 564 ReadFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll SUCCESS Offset: 1 536 512, Length: 16 384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,7223249 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 2 495 488, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,7537414 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 4 989 952, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,7700368 SexyCity.exe 564 Thread Exit SUCCESS Thread ID: 2448, User Time: 0.0000000, Kernel Time: 0.0000000 13:39:26,7700373 SexyCity.exe 564 Thread Exit SUCCESS Thread ID: 2148, User Time: 0.0000000, Kernel Time: 0.0000000 13:39:26,7700748 SexyCity.exe 564 Thread Exit SUCCESS Thread ID: 3752, User Time: 0.0000000, Kernel Time: 0.0000000 13:39:26,7701397 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Offset: 119 808, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,7858147 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll SUCCESS Offset: 295 936, Length: 24 576, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,7965844 SexyCity.exe 564 RegOpenKey HKCU\SOFTWARE\Microsoft\CTF SUCCESS Desired Access: Maximum Allowed 13:39:26,7966892 SexyCity.exe 564 RegQueryValue HKCU\Software\Microsoft\CTF\Disable Thread Input Manager SUCCESS Type: REG_DWORD, Length: 4, Data: 0 13:39:26,7967044 SexyCity.exe 564 RegCloseKey HKCU\Software\Microsoft\CTF SUCCESS 13:39:26,7967746 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\CTF\SystemShared SUCCESS Desired Access: Maximum Allowed 13:39:26,7968203 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\CTF\SystemShared\CUAS SUCCESS Type: REG_DWORD, Length: 4, Data: 1 13:39:26,7968340 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\CTF\SystemShared SUCCESS 13:39:26,7970993 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\ntdll.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:14, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:04, AllocationSize: 733 184, EndOfFile: 733 184, FileAttributes: A 13:39:26,7973632 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\ntdll.dll SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:14, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:04, AllocationSize: 733 184, EndOfFile: 733 184, FileAttributes: A 13:39:26,7974024 SexyCity.exe 564 ReadFile C:\WINDOWS\system32\MSCTFIME.IME SUCCESS Offset: 136 192, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8162499 SexyCity.exe 564 QueryOpen C:\WINDOWS\system32\MSCTFIME.IME SUCCESS CreationTime: 02/03/2006 13:00:00, LastAccessTime: 17/02/2011 13:39:26, LastWriteTime: 02/03/2006 13:00:00, ChangeTime: 08/09/2007 16:02:08, AllocationSize: 180 224, EndOfFile: 177 152, FileAttributes: A 13:39:26,8164112 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 1 614 848, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8213714 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 1 651 712, Length: 8 192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8215731 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 1 479 680, Length: 24 576, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8309930 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.564.11680359 NAME NOT FOUND Desired Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a 13:39:26,8312321 SexyCity.exe 564 CreateFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.564.11680359 NAME NOT FOUND Desired Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a 13:39:26,8312979 SexyCity.exe 564 CloseFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch SUCCESS 13:39:26,8316410 SexyCity.exe 564 CreateFile C:\Documents and Settings\DAMIEN\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch.564.11680359 NAME NOT FOUND Desired Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a 13:39:26,8316855 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 1 811 456, Length: 8 192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8357566 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 717 824, Length: 28 672, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8455621 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 4 580 352, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8484376 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 4 641 792, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8492792 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 2 212 864, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8572600 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 2 790 400, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8653671 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 3 032 064, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8681613 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 3 138 560, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8707758 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default SUCCESS 13:39:26,8709721 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\pubpol6.dat SUCCESS 13:39:26,8711293 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 3 015 680, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8714861 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 4 293 632, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8770389 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 4 826 112, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8845963 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 5 248 000, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8908632 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 1 975 296, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8913548 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll SUCCESS Offset: 2 860 032, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8926090 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 SUCCESS 13:39:26,8927028 SexyCity.exe 564 RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize SUCCESS Desired Access: Read 13:39:26,8927792 SexyCity.exe 564 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles NAME NOT FOUND Length: 20 13:39:26,8927951 SexyCity.exe 564 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize SUCCESS 13:39:26,8928449 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 140 288, Length: 8 192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8979235 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 156 672, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,8999860 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 205 824, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,9005566 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 189 440, Length: 16 384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,9008501 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 66 560, Length: 24 576, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,9011817 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 103 424, Length: 16 384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,9014642 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 263 168, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,9019279 SexyCity.exe 564 ReadFile C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll SUCCESS Offset: 336 896, Length: 32 768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O 13:39:26,9024200 SexyCity.exe 564 Thread Exit SUCCESS Thread ID: 3900, User Time: 0.0468750, Kernel Time: 0.2500000 13:39:26,9097237 SexyCity.exe 564 Process Exit SUCCESS Exit Status: -532459699, User Time: 0.0625000 seconds, Kernel Time: 0.2187500 seconds, Private Bytes: 11 493 376, Peak Private Bytes: 11 599 872, Working Set: 14 782 464, Peak Working Set: 14 827 520 13:39:26,9097612 SexyCity.exe 564 CloseFile C:\Program Files\Sexy City\2.0.0 SUCCESS 13:39:26,9099503 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03 SUCCESS 13:39:26,9100439 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS 13:39:26,9102167 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index34b.dat SUCCESS 13:39:26,9103359 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll SUCCESS 13:39:26,9106370 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS 13:39:26,9107517 SexyCity.exe 564 CloseFile C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll SUCCESS 13:39:26,9109040 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88 SUCCESS 13:39:26,9109992 SexyCity.exe 564 CloseFile C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989 SUCCESS