Remove base directory from File Activity

[Rurik]

In many runs, especially in Win7+, there are dozens of references to:
"[CreateFolder] Explorer.exe:XXXX > PathToMalware"

The script should have an additional filter, manually implemented into logic, that takes a given malware command line:
"C:\Malware\a.exe"
"%UserProfile\Desktop\Malware\a.exe"

Get os.path.dirname() and use that as a literal (*$) filter.

[Rurik]

I wrote this over a year ago, have looked at it a few times since, and can't determine what I was getting at. Keeping open until I figure out where my mind was that day.

[Rurik]

Over a bottle of vodka, I finally realized what I was playing at.

"[CreateFolder] Explorer.exe:199 > C:\malware"
"[CreateFolder] Explorer.exe:199 > C:\malware"
"[CreateFolder] Explorer.exe:199 > C:\malware"
"[CreateFolder] Explorer.exe:199 > C:\malware"

So need to remove all these items by sorting out "C:\malware\malware.exe" to "C:\malware", if that's the sole argument then remove it.