Code: Select all
"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"8:49:09,2893752","Far.exe","5136","IRP_MJ_CREATE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"8:49:09,2894837","Far.exe","5136","IRP_MJ_DIRECTORY_CONTROL","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors\*","SUCCESS","Type: QueryDirectory, Filter: *, 2: ., FileInformationClass: FileIdBothDirectoryInformation, 4: Custom Highlighting, 5: Default Highlighting, 6: Descript.ion, 7: Interface"
"8:49:09,2896420","Far.exe","5136","IRP_MJ_DIRECTORY_CONTROL","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors\*","NO MORE FILES","Type: QueryDirectory, Filter: *"
"8:49:09,2897466","Far.exe","5136","IRP_MJ_CLEANUP","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS",""
"8:49:09,2897620","Far.exe","5136","IRP_MJ_CLOSE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS",""
"8:49:09,2899236","Far.exe","5136","IRP_MJ_CREATE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"8:49:09,2899907","Far.exe","5136","IRP_MJ_QUERY_INFORMATION","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS","Type: QueryNameInformationFile, Name: \=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors"
"8:49:09,2900536","Far.exe","5136","IRP_MJ_CLEANUP","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS",""
"8:49:09,2900623","Far.exe","5136","IRP_MJ_CLOSE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS",""
"8:49:09,2900854","Far.exe","5136","IRP_MJ_CREATE","C:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"8:49:09,2901101","Far.exe","5136","IRP_MJ_QUERY_INFORMATION","C:\","SUCCESS","Type: QueryNameInformationFile, Name: \"
"8:49:09,2901224","Far.exe","5136","IRP_MJ_QUERY_VOLUME_INFORMATION","C:\","SUCCESS","Type: QueryInformationVolume, VolumeCreationTime: 19.05.2011 17:40:35, VolumeSerialNumber: C8F4-4CEE, SupportsObjects: True, VolumeLabel: Диск Ц"
"8:49:09,2901716","Far.exe","5136","IRP_MJ_QUERY_VOLUME_INFORMATION","C:\","SUCCESS","Type: QueryAttributeInformationVolume, FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"8:49:09,2901865","Far.exe","5136","IRP_MJ_CLEANUP","C:\","SUCCESS",""
"8:49:09,2901946","Far.exe","5136","IRP_MJ_CLOSE","C:\","SUCCESS",""
"8:49:09,2903129","Far.exe","5136","IRP_MJ_CREATE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"8:49:09,2904051","Far.exe","5136","IRP_MJ_DIRECTORY_CONTROL","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors\*","SUCCESS","Type: QueryDirectory, Filter: *, 2: ., FileInformationClass: FileIdBothDirectoryInformation, 4: Custom Highlighting, 5: Default Highlighting, 6: Descript.ion, 7: Interface"
"8:49:09,2905676","Far.exe","5136","IRP_MJ_DIRECTORY_CONTROL","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors\*","NO MORE FILES","Type: QueryDirectory, Filter: *"
"8:49:09,2906687","Far.exe","5136","IRP_MJ_CREATE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"8:49:09,2907315","Far.exe","5136","FASTIO_QUERY_INFORMATION","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS","Type: QueryBasicInformationFile, CreationTime: 26.09.2025 13:47:43, LastAccessTime: 07.10.2025 8:49:09, LastWriteTime: 12.09.2025 5:25:15, ChangeTime: 26.09.2025 13:48:29, FileAttributes: DC"
"8:49:09,2910504","Far.exe","5136","IRP_MJ_CLEANUP","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS",""
"8:49:09,2910632","Far.exe","5136","IRP_MJ_CLOSE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS",""
"8:49:09,2912011","Far.exe","5136","IRP_MJ_CLEANUP","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS",""
"8:49:09,2912095","Far.exe","5136","IRP_MJ_CLOSE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS",""
"8:49:09,3019496","Far.exe","5136","IRP_MJ_CLEANUP","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons","SUCCESS",""
"8:49:09,3019776","Far.exe","5136","IRP_MJ_CLOSE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons","SUCCESS",""
"8:49:09,3021138","Far.exe","5136","IRP_MJ_CREATE","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Synchronize, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"8:49:09,3021923","Far.exe","5136","IRP_MJ_DIRECTORY_CONTROL","C:\=\=MyDoc\Полученные файлы\Far30b6547.x86.20250912\Addons\Colors","","Type: NotifyChangeDirectory, Filter: FILE_NOTIFY_CHANGE_FILE_NAME, FILE_NOTIFY_CHANGE_DIR_NAME, FILE_NOTIFY_CHANGE_ATTRIBUTES, FILE_NOTIFY_CHANGE_SIZE, FILE_NOTIFY_CHANGE_LAST_WRITE, FILE_NOTIFY_CHANGE_LAST_ACCESS, FILE_NOTIFY_CHANGE_CREATION, FILE_NOTIFY_CHANGE_SECURITY"
"8:49:09,3024508","Far.exe","5136","RegOpenKey","HKCU","SUCCESS","Desired Access: All Access"
"8:49:09,3024988","Far.exe","5136","RegCreateKey","HKCU\Software\Microsoft\Windows NT\CurrentVersion\Time Zones","SUCCESS","Desired Access: All Access"
"8:49:09,3025320","Far.exe","5136","RegCloseKey","HKCU","SUCCESS",""
"8:49:09,3025428","Far.exe","5136","RegQueryValue","HKCU\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\TimeZoneKeyName","SUCCESS","Type: REG_SZ, Length: 54, Data: Ekaterinburg Standard Time"
"8:49:09,3025532","Far.exe","5136","RegOpenKey","HKLM\Software\Microsoft\Windows NT\currentVersion\Time Zones\Ekaterinburg Standard Time","SUCCESS","Desired Access: Read"
"8:49:09,3025816","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Std","SUCCESS","Type: REG_SZ, Length: 26, Data: RTZ 4 (зима)"
"8:49:09,3025886","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dlt","SUCCESS","Type: REG_SZ, Length: 2, Data: "
"8:49:09,3025946","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Tzi","SUCCESS","Type: REG_BINARY, Length: 44, Data: D4 FE FF FF 00 00 00 00 C4 FF FF FF 00 00 00 00"
"8:49:09,3026046","Far.exe","5136","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time","SUCCESS",""
"8:49:09,3026138","Far.exe","5136","RegCloseKey","HKCU\Software\Microsoft\Windows NT\CurrentVersion\Time Zones","SUCCESS",""
"8:49:09,3026183","Far.exe","5136","RegOpenKey","HKLM\Software\Microsoft\Windows NT\currentVersion\Time Zones\Ekaterinburg Standard Time","SUCCESS","Desired Access: Read"
"8:49:09,3026391","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Std","SUCCESS","Type: REG_SZ, Length: 26, Data: RTZ 4 (зима)"
"8:49:09,3026450","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dlt","SUCCESS","Type: REG_SZ, Length: 2, Data: "
"8:49:09,3026504","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Tzi","SUCCESS","Type: REG_BINARY, Length: 44, Data: D4 FE FF FF 00 00 00 00 C4 FF FF FF 00 00 00 00"
"8:49:09,3026586","Far.exe","5136","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time","SUCCESS",""
"8:49:09,3026646","Far.exe","5136","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST","SUCCESS","Desired Access: Read, Maximum Allowed"
"8:49:09,3026970","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST\FirstEntry","SUCCESS","Type: REG_DWORD, Length: 4, Data: 2010"
"8:49:09,3027059","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST\LastEntry","SUCCESS","Type: REG_DWORD, Length: 4, Data: 2015"
"8:49:09,3027124","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST\2025","NAME NOT FOUND","Length: 4 094"
"8:49:09,3027220","Far.exe","5136","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST","SUCCESS",""
"8:49:09,3027291","Far.exe","5136","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST","SUCCESS","Desired Access: Read, Maximum Allowed"
"8:49:09,3027541","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST\2015","SUCCESS","Type: REG_BINARY, Length: 44, Data: D4 FE FF FF 00 00 00 00 C4 FF FF FF 00 00 00 00 E3 0A 00 00"
"8:49:09,3027632","Far.exe","5136","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST","SUCCESS",""
"8:49:09,3027899","Far.exe","5136","RegOpenKey","HKCU","SUCCESS","Desired Access: All Access"
"8:49:09,3028097","Far.exe","5136","RegCreateKey","HKCU\Software\Microsoft\Windows NT\CurrentVersion\Time Zones","SUCCESS","Desired Access: All Access"
"8:49:09,3028308","Far.exe","5136","RegCloseKey","HKCU","SUCCESS",""
"8:49:09,3028381","Far.exe","5136","RegQueryValue","HKCU\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\TimeZoneKeyName","SUCCESS","Type: REG_SZ, Length: 54, Data: Ekaterinburg Standard Time"
"8:49:09,3028428","Far.exe","5136","RegOpenKey","HKLM\Software\Microsoft\Windows NT\currentVersion\Time Zones\Ekaterinburg Standard Time","SUCCESS","Desired Access: Read"
"8:49:09,3028634","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Std","SUCCESS","Type: REG_SZ, Length: 26, Data: RTZ 4 (зима)"
"8:49:09,3028935","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dlt","SUCCESS","Type: REG_SZ, Length: 2, Data: "
"8:49:09,3028993","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Tzi","SUCCESS","Type: REG_BINARY, Length: 44, Data: D4 FE FF FF 00 00 00 00 C4 FF FF FF 00 00 00 00"
"8:49:09,3029074","Far.exe","5136","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time","SUCCESS",""
"8:49:09,3029157","Far.exe","5136","RegCloseKey","HKCU\Software\Microsoft\Windows NT\CurrentVersion\Time Zones","SUCCESS",""
"8:49:09,3029199","Far.exe","5136","RegOpenKey","HKLM\Software\Microsoft\Windows NT\currentVersion\Time Zones\Ekaterinburg Standard Time","SUCCESS","Desired Access: Read"
"8:49:09,3029406","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Std","SUCCESS","Type: REG_SZ, Length: 26, Data: RTZ 4 (зима)"
"8:49:09,3029465","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dlt","SUCCESS","Type: REG_SZ, Length: 2, Data: "
"8:49:09,3029521","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Tzi","SUCCESS","Type: REG_BINARY, Length: 44, Data: D4 FE FF FF 00 00 00 00 C4 FF FF FF 00 00 00 00"
"8:49:09,3029600","Far.exe","5136","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time","SUCCESS",""
"8:49:09,3029645","Far.exe","5136","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST","SUCCESS","Desired Access: Read, Maximum Allowed"
"8:49:09,3029916","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST\FirstEntry","SUCCESS","Type: REG_DWORD, Length: 4, Data: 2010"
"8:49:09,3030016","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST\LastEntry","SUCCESS","Type: REG_DWORD, Length: 4, Data: 2015"
"8:49:09,3030078","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST\2025","NAME NOT FOUND","Length: 4 094"
"8:49:09,3030162","Far.exe","5136","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST","SUCCESS",""
"8:49:09,3030228","Far.exe","5136","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST","SUCCESS","Desired Access: Read, Maximum Allowed"
"8:49:09,3030480","Far.exe","5136","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST\2015","SUCCESS","Type: REG_BINARY, Length: 44, Data: D4 FE FF FF 00 00 00 00 C4 FF FF FF 00 00 00 00 E3 0A 00 00"
"8:49:09,3030568","Far.exe","5136","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Ekaterinburg Standard Time\Dynamic DST","SUCCESS",""