"13:20:52,3060022,""SASPlanet.exe"",""2512"",""ReadFile"",""\\CFS\gis$\Cache\sat\z5\0\x10\0\y2.jpg"",""SUCCESS"",""Offset: 0, Length: 1 024"""
"13:20:52,3060242,""SASPlanet.exe"",""2512"",""ReadFile"",""\\CFS\gis$\Cache\sat\z5\0\x10\0\y2.jpg"",""SUCCESS"",""Offset: 0, Length: 4 096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"""
"13:20:52,3067405,""SASPlanet.exe"",""2512"",""CloseFile"",""\\CFS\gis$\Cache\sat\z5\0\x10\0\y2.jpg"",""SUCCESS"","""""
"13:20:52,3185891,""SASPlanet.exe"",""2512"",""CreateFile"",""\\CFS\gis$\Cache\sat\z5\0\x10\0\y2.jpg"",""SUCCESS"",""Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"""
"13:20:52,3207574,""SASPlanet.exe"",""2512"",""QueryStandardInformationFile"",""\\CFS\gis$\Cache\sat\z5\0\x10\0\y2.jpg"",""SUCCESS"",""AllocationSize: 8 192, EndOfFile: 5 281, NumberOfLinks: 1, DeletePending: False, Directory: False"""
"13:20:52,3208059,""SASPlanet.exe"",""2512"",""ReadFile"",""\\CFS\gis$\Cache\sat\z5\0\x10\0\y2.jpg"",""SUCCESS"",""Offset: 0, Length: 5 281"""
"13:20:52,3208255,""SASPlanet.exe"",""2512"",""ReadFile"",""\\CFS\gis$\Cache\sat\z5\0\x10\0\y2.jpg"",""SUCCESS"",""Offset: 0, Length: 5 281, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"""
"13:20:52,3216794,""SASPlanet.exe"",""2512"",""CloseFile"",""\\CFS\gis$\Cache\sat\z5\0\x10\0\y2.jpg"",""SUCCESS"","""""
"13:20:52,3451225,""SASPlanet.exe"",""2512"",""CreateFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"""
"13:20:52,3542446,""SASPlanet.exe"",""2512"",""QueryNetworkOpenInformationFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""CreationTime: 14.01.2013 16:54:28, LastAccessTime: 14.01.2013 16:54:28, LastWriteTime: 14.01.2013 16:54:12, ChangeTime: 14.01.2013 22:57:33, AllocationSize: 01.01.1601 4:00:00, EndOfFile: 01.01.1601 4:00:00, FileAttributes: N"""
"13:20:52,3546893,""SASPlanet.exe"",""2512"",""CloseFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"","""""
"13:20:52,3664743,""SASPlanet.exe"",""2512"",""CreateFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"""
"13:20:52,3846352,""SASPlanet.exe"",""2512"",""QueryStandardInformationFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""AllocationSize: 4 096, EndOfFile: 3 815, NumberOfLinks: 1, DeletePending: False, Directory: False"""
"13:20:52,3846721,""SASPlanet.exe"",""2512"",""QueryBasicInformationFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""CreationTime: 14.01.2013 16:54:28, LastAccessTime: 14.01.2013 16:54:28, LastWriteTime: 14.01.2013 16:54:12, ChangeTime: 14.01.2013 22:57:33, FileAttributes: N"""
"13:20:52,3847115,""SASPlanet.exe"",""2512"",""ReadFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""Offset: 0, Length: 1 024"""
"13:20:52,3847507,""SASPlanet.exe"",""2512"",""ReadFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""Offset: 0, Length: 3 815, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"""
"13:20:52,3854583,""SASPlanet.exe"",""2512"",""CloseFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"","""""
"13:20:52,3964239,""SASPlanet.exe"",""2512"",""CreateFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"""
"13:20:52,3978552,""SASPlanet.exe"",""2512"",""QueryStandardInformationFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""AllocationSize: 4 096, EndOfFile: 3 815, NumberOfLinks: 1, DeletePending: False, Directory: False"""
"13:20:52,3978892,""SASPlanet.exe"",""2512"",""ReadFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""Offset: 0, Length: 3 815"""
"13:20:52,3979137,""SASPlanet.exe"",""2512"",""ReadFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"",""Offset: 0, Length: 3 815, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"""
"13:20:52,3986221,""SASPlanet.exe"",""2512"",""CloseFile"",""\\CFS\gis$\Cache\sat\z5\0\x11\0\y2.jpg"",""SUCCESS"","""""
"13:21:00,8847545,""SASPlanet.exe"",""2512"",""QueryOpen"",""C:\WINDOWS\system32\msctf.dll"",""SUCCESS"",""CreationTime: 18.08.2004 16:00:00, LastAccessTime: 15.01.2013 13:20:28, LastWriteTime: 14.04.2008 20:10:39, ChangeTime: 30.10.2008 13:31:36, AllocationSize: 299 008, EndOfFile: 297 984, FileAttributes: A"""
"13:21:00,8849331,""SASPlanet.exe"",""2512"",""QueryOpen"",""C:\WINDOWS\system32\msctf.dll"",""SUCCESS"",""CreationTime: 18.08.2004 16:00:00, LastAccessTime: 15.01.2013 13:20:28, LastWriteTime: 14.04.2008 20:10:39, ChangeTime: 30.10.2008 13:31:36, AllocationSize: 299 008, EndOfFile: 297 984, FileAttributes: A"""
"13:21:00,8850621,""SASPlanet.exe"",""2512"",""Thread Exit"","""",""SUCCESS"",""Thread ID: 3508, User Time: 0.0000000, Kernel Time: 0.0937500"""
"13:21:10,4487488,""SASPlanet.exe"",""2512"",""Thread Exit"","""",""SUCCESS"",""Thread ID: 3260, User Time: 0.0156250, Kernel Time: 0.0468750"""
"13:21:19,8845047,""SASPlanet.exe"",""2512"",""Thread Exit"","""",""SUCCESS"",""Thread ID: 2524, User Time: 0.0000000, Kernel Time: 0.1406250"""
"13:21:33,1869792,""SASPlanet.exe"",""2512"",""QueryOpen"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""CreationTime: 18.08.2004 16:00:00, LastAccessTime: 15.01.2013 13:20:52, LastWriteTime: 14.04.2008 20:10:40, ChangeTime: 30.10.2008 13:31:36, AllocationSize: 159 744, EndOfFile: 159 232, FileAttributes: A"""
"13:21:33,1871774,""SASPlanet.exe"",""2512"",""CreateFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"""
"13:21:33,1872011,""SASPlanet.exe"",""2512"",""QueryStandardInformationFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""AllocationSize: 159 744, EndOfFile: 159 232, NumberOfLinks: 1, DeletePending: False, Directory: False"""
"13:21:33,1872077,""SASPlanet.exe"",""2512"",""QueryBasicInformationFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""CreationTime: 18.08.2004 16:00:00, LastAccessTime: 15.01.2013 13:20:52, LastWriteTime: 14.04.2008 20:10:40, ChangeTime: 30.10.2008 13:31:36, FileAttributes: A"""
"13:21:33,1872196,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 0, Length: 4 160"""
"13:21:33,1872590,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 1 594, Length: 1 024"""
"13:21:33,1872733,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 2 020, Length: 228"""
"13:21:33,1872824,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 147 156, Length: 160"""
"13:21:33,1873019,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 0, Length: 1 024"""
"13:21:33,1873172,""SASPlanet.exe"",""2512"",""CloseFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"","""""
"13:21:33,1874751,""SASPlanet.exe"",""2512"",""CreateFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"""
"13:21:33,1875025,""SASPlanet.exe"",""2512"",""CreateFileMapping"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"""
"13:21:33,1875081,""SASPlanet.exe"",""2512"",""QueryStandardInformationFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""AllocationSize: 159 744, EndOfFile: 159 232, NumberOfLinks: 1, DeletePending: False, Directory: False"""
"13:21:33,1875190,""SASPlanet.exe"",""2512"",""CreateFileMapping"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""SyncType: SyncTypeOther"""
"13:21:33,1875536,""SASPlanet.exe"",""2512"",""CloseFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"","""""
"13:21:35,4477296,""SASPlanet.exe"",""2512"",""Thread Create"","""",""SUCCESS"",""Thread ID: 3984"""
"13:21:49,5228745,""SASPlanet.exe"",""2512"",""QueryOpen"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""CreationTime: 18.08.2004 16:00:00, LastAccessTime: 15.01.2013 13:21:36, LastWriteTime: 14.04.2008 20:10:40, ChangeTime: 30.10.2008 13:31:36, AllocationSize: 159 744, EndOfFile: 159 232, FileAttributes: A"""
"13:21:49,5230984,""SASPlanet.exe"",""2512"",""CreateFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"""
"13:21:49,5231371,""SASPlanet.exe"",""2512"",""QueryStandardInformationFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""AllocationSize: 159 744, EndOfFile: 159 232, NumberOfLinks: 1, DeletePending: False, Directory: False"""
"13:21:49,5231443,""SASPlanet.exe"",""2512"",""QueryBasicInformationFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""CreationTime: 18.08.2004 16:00:00, LastAccessTime: 15.01.2013 13:21:36, LastWriteTime: 14.04.2008 20:10:40, ChangeTime: 30.10.2008 13:31:36, FileAttributes: A"""
"13:21:49,5231575,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 0, Length: 4 160"""
"13:21:49,5232117,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 1 594, Length: 1 024"""
"13:21:49,5232256,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 2 020, Length: 228"""
"13:21:49,5232347,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 147 156, Length: 160"""
"13:21:49,5232542,""SASPlanet.exe"",""2512"",""ReadFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Offset: 0, Length: 1 024"""
"13:21:49,5232696,""SASPlanet.exe"",""2512"",""CloseFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"","""""
"13:21:49,5234256,""SASPlanet.exe"",""2512"",""CreateFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"""
"13:21:49,5234496,""SASPlanet.exe"",""2512"",""CreateFileMapping"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"""
"13:21:49,5234554,""SASPlanet.exe"",""2512"",""QueryStandardInformationFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""AllocationSize: 159 744, EndOfFile: 159 232, NumberOfLinks: 1, DeletePending: False, Directory: False"""
"13:21:49,5234658,""SASPlanet.exe"",""2512"",""CreateFileMapping"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"",""SyncType: SyncTypeOther"""
"13:21:49,5234959,""SASPlanet.exe"",""2512"",""CloseFile"",""C:\WINDOWS\system32\msimtf.dll"",""SUCCESS"","""""
"13:22:15,4474916,""SASPlanet.exe"",""2512"",""Thread Exit"","""",""SUCCESS"",""Thread ID: 3984, User Time: 0.0000000, Kernel Time: 0.0000000"""
"13:22:35,4473872,""SASPlanet.exe"",""2512"",""Thread Create"","""",""SUCCESS"",""Thread ID: 3020"""
"13:23:15,4472626,""SASPlanet.exe"",""2512"",""Thread Exit"","""",""SUCCESS"",""Thread ID: 3020, User Time: 0.0000000, Kernel Time: 0.0000000"""