# Time sent Dur. Process Request IRP Flags FsContext Path Status More info 17 20:06:27.375 8920 explorer.exe IRP_MJ_DIRECTORY_CONTROL/IRP_MN_NOTIFY_CHANGE_DIRECTORY 00060000 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_CANCELLED 20 20:06:27.375 8920 explorer.exe IRP_MJ_DIRECTORY_CONTROL/IRP_MN_NOTIFY_CHANGE_DIRECTORY 00060000 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_CANCELLED 1 20:06:35.619 WmiPrvSE.exe IRP_MJ_CLEANUP 00000404 FFFFF8021896A400 \Device\Mup[-=Error 0xc00000 STATUS_SUCCESS 2 20:06:35.619 WmiPrvSE.exe IRP_MJ_CLOSE 00000404 FFFFF8021896A400 \Device\Mup[-=Not In Cache=-] STATUS_SUCCESS 3 20:06:36.233 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000021 Access: 00100001 Share: 00000007 Attrib: 0 Result: FILE_OPENED 4 20:06:36.233 explorer.exe IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00060800 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS FileBothDirectoryInformation FileMask: 123.txt 5 20:06:36.233 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 6 20:06:36.233 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 7 20:06:36.292 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000020 Access: 00100081 Share: 00000007 Attrib: 0 Result: FILE_OPENED 8 20:06:36.292 explorer.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_INVALID_PARAMETER 00000037 9 20:06:36.292 explorer.exe IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00060800 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS FileIdBothDirectoryInformation FileMask: 10 20:06:36.292 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 11 20:06:36.292 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 12 20:06:36.293 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000020 Access: 00120089 Share: 00000007 Attrib: 0 Result: FILE_OPENED 13 20:06:36.293 explorer.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_INVALID_PARAMETER 00000037 14 20:06:36.293 explorer.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS FileFsFullSizeInformation TotalClusters: 200000000 CallerClusters: 1FFFC0000 AvailClusters: 1FFFC0000 SectorsPerClus: 1 BytesPerSect: 200 15 20:06:36.293 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 16 20:06:36.293 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 18 20:06:36.295 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 19 20:06:36.295 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 21 20:06:36.295 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 22 20:06:36.295 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BA9F93B00 \Device\Mup\memfs64\share STATUS_SUCCESS 23 20:06:36.299 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FILE_OPEN CreOpts: 00200044 Access: 00120089 Share: 00000005 Attrib: 0 Result: FILE_OPENED 24 20:06:36.299 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileAttributeTagInformation 25 20:06:36.299 explorer.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileFsDeviceInformation DeviceType: FILE_DEVICE_DISK Characteristics: 00000010 26 20:06:36.299 explorer.exe IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_USER_FS_REQUEST 00060800 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_INVALID_DEVICE_REQUEST IOCTL_LMR_DISABLE_LOCAL_BUFFERING (00140390) 27 20:06:36.300 explorer.exe IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_USER_FS_REQUEST 00060830 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_INVALID_DEVICE_REQUEST FSCTL_LMR_GET_HINT_SIZE (001401C4) 28 20:06:36.300 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileStandardInformation AllocationSize: 00000000-00000200 EndOfFile: 00000000-00000006 NumberOfLinks: 1 DeletePending: FALSE 29 20:06:36.300 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-8C472AEF LastAccTime: 01DA9552-8C475207 LastWrtTime: 01DA9552-8C475207 ChangeTime: 01DA9552-8C475207 Attrib: 00000020 30 20:06:36.300 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileStreamInformation 31 20:06:36.300 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-8C472AEF LastAccTime: 01DA9552-8C475207 LastWrtTime: 01DA9552-8C475207 ChangeTime: 01DA9552-8C475207 Attrib: 00000020 32 20:06:36.300 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileEaInformation EaSize: 00000000 33 20:06:36.300 explorer.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileFsAttributeInformation FileSysAttr: 0084048E MaxNameLen: 255 FsName: NTFS 34 20:06:36.300 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_INVALID_PARAMETER 00000037 35 20:06:36.300 explorer.exe IRP_MJ_QUERY_SECURITY 00000004 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS 36 20:06:36.300 explorer.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileFsDeviceInformation DeviceType: FILE_DEVICE_DISK Characteristics: 00000010 37 20:06:36.300 explorer.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileFsAttributeInformation FileSysAttr: 0084048E MaxNameLen: 255 FsName: NTFS 38 20:06:36.300 explorer.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS FileFsDeviceInformation DeviceType: FILE_DEVICE_DISK Characteristics: 00000010 39 20:06:36.300 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_INVALID_PARAMETER 00000037 40 20:06:36.300 explorer.exe IRP_MJ_READ 00060900 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS Offset: 00000000-00000000 ToRead: 6 Read: 6 41 20:06:36.300 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS 42 20:06:36.301 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 0 Access: 00100081 Share: 00000007 Attrib: 0 Result: FILE_OPENED 43 20:06:36.301 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 44 20:06:36.301 explorer.exe IRP_MJ_PNP/IRP_MN_QUERY_DEVICE_RELATIONS 00000000 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_INVALID_DEVICE_REQUEST 45 20:06:36.301 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 0 Access: 00100081 Share: 00000007 Attrib: 0 Result: FILE_OPENED 46 20:06:36.301 explorer.exe IRP_MJ_QUERY_INFORMATION 00060874 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 47 20:06:36.301 explorer.exe IRP_MJ_PNP/IRP_MN_QUERY_DEVICE_RELATIONS 00000000 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_INVALID_DEVICE_REQUEST 48 20:06:36.305 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 49 20:06:36.305 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 50 20:06:36.305 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 51 20:06:36.305 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 52 20:06:36.305 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 53 20:06:36.305 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 54 20:06:36.305 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 55 20:06:36.305 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 56 20:06:36.305 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 57 20:06:36.305 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 58 20:06:36.307 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\share STATUS_BAD_NETWORK_NAME FILE_OPEN CreOpts: 000000A0 Access: 00100001 Share: 00000007 Attrib: 00000080 59 20:06:36.307 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000020 Access: 00100080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 60 20:06:36.307 explorer.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_INVALID_PARAMETER FileNetworkPhysicalNameInformation 61 20:06:36.307 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 62 20:06:36.307 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 63 20:06:36.307 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\PIPE\srvsvc STATUS_BAD_NETWORK_PATH FILE_OPEN CreOpts: 0 Access: 0012019F Share: 00000003 Attrib: 0 65 20:06:36.307 2256 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\IPC$ STATUS_BAD_NETWORK_PATH FILE_OPEN_IF CreOpts: 000000A0 Access: 0012019F Share: 00000003 Attrib: 00000080 64 20:06:36.748 System IRP_MJ_CLOSE 00000404 FFFF940BBF4F2D60 \Device\Mup\memfs64\share\123.txt STATUS_SUCCESS 66 20:06:38.565 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\PIPE\srvsvc STATUS_BAD_NETWORK_PATH FILE_OPEN CreOpts: 0 Access: 0012019F Share: 00000003 Attrib: 0 67 20:06:38.565 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\IPC$ STATUS_BAD_NETWORK_PATH FILE_OPEN_IF CreOpts: 000000A0 Access: 0012019F Share: 00000003 Attrib: 00000080 68 20:06:40.817 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200020 Access: 00100080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 69 20:06:40.817 explorer.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileNetworkOpenInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 00000010 70 20:06:40.817 explorer.exe IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_USER_FS_REQUEST 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_INVALID_DEVICE_REQUEST FSCTL_CREATE_OR_GET_OBJECT_ID (000900C0) 71 20:06:40.817 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 72 20:06:40.817 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 73 20:06:40.817 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\share STATUS_BAD_NETWORK_NAME FILE_OPEN CreOpts: 000000A0 Access: 00100001 Share: 00000007 Attrib: 00000080 74 20:06:40.817 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000020 Access: 00100080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 75 20:06:40.817 explorer.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_INVALID_PARAMETER FileNetworkPhysicalNameInformation 76 20:06:40.817 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 77 20:06:40.817 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 78 20:06:40.818 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\PIPE\srvsvc STATUS_BAD_NETWORK_PATH FILE_OPEN CreOpts: 0 Access: 0012019F Share: 00000003 Attrib: 0 79 20:06:40.818 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\IPC$ STATUS_BAD_NETWORK_PATH FILE_OPEN_IF CreOpts: 000000A0 Access: 0012019F Share: 00000003 Attrib: 00000080 80 20:06:40.818 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\PIPE\srvsvc STATUS_BAD_NETWORK_PATH FILE_OPEN CreOpts: 0 Access: 0012019F Share: 00000003 Attrib: 0 81 20:06:40.818 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\IPC$ STATUS_BAD_NETWORK_PATH FILE_OPEN_IF CreOpts: 000000A0 Access: 0012019F Share: 00000003 Attrib: 00000080 82 20:06:43.076 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200020 Access: 00100080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 83 20:06:43.076 explorer.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileNetworkOpenInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 00000010 84 20:06:43.076 explorer.exe IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_USER_FS_REQUEST 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_INVALID_DEVICE_REQUEST FSCTL_CREATE_OR_GET_OBJECT_ID (000900C0) 85 20:06:43.076 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 86 20:06:43.076 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 87 20:06:43.077 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\share STATUS_BAD_NETWORK_NAME FILE_OPEN CreOpts: 000000A0 Access: 00100001 Share: 00000007 Attrib: 00000080 88 20:06:43.077 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000020 Access: 00100080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 89 20:06:43.077 explorer.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_INVALID_PARAMETER FileNetworkPhysicalNameInformation 90 20:06:43.077 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 91 20:06:43.077 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 92 20:06:43.077 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\PIPE\srvsvc STATUS_BAD_NETWORK_PATH FILE_OPEN CreOpts: 0 Access: 0012019F Share: 00000003 Attrib: 0 93 20:06:43.077 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\IPC$ STATUS_BAD_NETWORK_PATH FILE_OPEN_IF CreOpts: 000000A0 Access: 0012019F Share: 00000003 Attrib: 00000080 94 20:06:43.077 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\PIPE\srvsvc STATUS_BAD_NETWORK_PATH FILE_OPEN CreOpts: 0 Access: 0012019F Share: 00000003 Attrib: 0 95 20:06:43.077 explorer.exe IRP_MJ_CREATE 00000884 0000000000000000 \Device\Mup\memfs64\IPC$ STATUS_BAD_NETWORK_PATH FILE_OPEN_IF CreOpts: 000000A0 Access: 0012019F Share: 00000003 Attrib: 00000080 96 20:06:45.332 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200020 Access: 00100080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 97 20:06:45.332 explorer.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileNetworkOpenInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 00000010 98 20:06:45.332 explorer.exe IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_USER_FS_REQUEST 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_INVALID_DEVICE_REQUEST FSCTL_CREATE_OR_GET_OBJECT_ID (000900C0) 99 20:06:45.332 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 100 20:06:45.332 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 101 20:06:45.339 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 102 20:06:45.339 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 103 20:06:45.339 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 104 20:06:45.339 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 105 20:06:45.339 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 106 20:06:45.430 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 107 20:06:45.430 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 108 20:06:45.430 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 109 20:06:45.430 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 110 20:06:45.430 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 111 20:06:45.430 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 112 20:06:45.430 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 113 20:06:45.431 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 114 20:06:45.431 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 115 20:06:45.431 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 116 20:06:45.530 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 117 20:06:45.530 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 118 20:06:45.530 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 119 20:06:45.530 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 120 20:06:45.530 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 121 20:06:45.530 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 122 20:06:45.530 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 123 20:06:45.530 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 124 20:06:45.530 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 125 20:06:45.530 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 126 20:06:45.580 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 127 20:06:45.580 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 128 20:06:45.580 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 129 20:06:45.580 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 130 20:06:45.580 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 131 20:06:45.580 explorer.exe FASTIO_QUERY_OPEN 0000000000000000 \Device\Mup\memfs64\share FAILURE 132 20:06:45.580 explorer.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00200000 Access: 00000080 Share: 00000007 Attrib: 0 Result: FILE_OPENED 133 20:06:45.580 explorer.exe FASTIO_QUERY_BASIC_INFO FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileBasicInformation CreateTime: 01DA9552-84DBF583 LastAccTime: 01DA9552-8D044FAD LastWrtTime: 01DA9552-8D044FAD ChangeTime: 01DA9552-8D044FAD Attrib: 00000010 134 20:06:45.580 explorer.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 135 20:06:45.580 explorer.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 136 20:06:56.558 bkmonitorbeat.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000021 Access: 00100000 Share: 00000003 Attrib: 0 Result: FILE_OPENED 137 20:06:56.558 bkmonitorbeat.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileNameInformation Name: \memfs64\share\ 138 20:06:56.558 bkmonitorbeat.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileFsVolumeInformation CreateTime: 01DA9552-84DBA765 SerialNumber: 1C37F89C SupportsObjects: 0 VolumeLabel: MEMFS 139 20:06:56.559 bkmonitorbeat.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileFsAttributeInformation FileSysAttr: 0084048E MaxNameLen: 255 FsName: NTFS 140 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 141 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 142 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000021 Access: 00100000 Share: 00000003 Attrib: 0 Result: FILE_OPENED 143 20:06:56.559 bkmonitorbeat.exe IRP_MJ_QUERY_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileNameInformation Name: \memfs64\share\ 144 20:06:56.559 bkmonitorbeat.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileFsVolumeInformation CreateTime: 01DA9552-84DBA765 SerialNumber: 1C37F89C SupportsObjects: 0 VolumeLabel: MEMFS 145 20:06:56.559 bkmonitorbeat.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileFsAttributeInformation FileSysAttr: 0084048E MaxNameLen: 255 FsName: NTFS 146 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 147 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 148 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00000021 Access: 00100000 Share: 00000003 Attrib: 0 Result: FILE_OPENED 149 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 150 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 151 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CREATE 00000884 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FILE_OPEN CreOpts: 00800021 Access: 00100000 Share: 0 Attrib: 0 Result: FILE_OPENED 152 20:06:56.559 bkmonitorbeat.exe IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS FileFsFullSizeInformation TotalClusters: 200000000 CallerClusters: 1FFFC0000 AvailClusters: 1FFFC0000 SectorsPerClus: 1 BytesPerSect: 200 153 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CLEANUP 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS 154 20:06:56.559 bkmonitorbeat.exe IRP_MJ_CLOSE 00000404 FFFF940BC2DB0900 \Device\Mup\memfs64\share STATUS_SUCCESS