Deltree \clients\client1
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients
NTCreateX \clients 0x1 0x3 13780
Close 13780
NTCreateX \clients\client1 0x1 0x2 13781
Close 13781
NTCreateX \clients\client1\mixfile 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\FILLER"*
NTCreateX \clients\client1\~dmtmp 0x1 0x2 13785
Close 13785
NTCreateX \clients\client1\filler.000 0x40 0x2 13786
QUERY_FS_INFORMATION 1
WriteX 13786 65534 1 1
QUERY_FILE_INFORMATION 13786
WriteX 13786 0 65471 65471
WriteX 13786 65471 65 65
WriteX 13786 65536 65471 65471
WriteX 13786 131007 65 65
WriteX 13786 131072 65471 65471
WriteX 13786 196543 65 65
WriteX 13786 196608 65471 65471
WriteX 13786 262079 65 65
WriteX 13786 262144 65471 65471
WriteX 13786 327615 65 65
WriteX 13786 327680 65471 65471
WriteX 13786 393151 65 65
WriteX 13786 393216 65471 65471
WriteX 13786 458687 65 65
WriteX 13786 458752 65471 65471
WriteX 13786 524223 65 65
WriteX 13786 524288 65471 65471
WriteX 13786 589759 65 65
WriteX 13786 589824 65471 65471
WriteX 13786 655295 65 65
WriteX 13786 655360 65471 65471
WriteX 13786 720831 65 65
WriteX 13786 720896 65471 65471
WriteX 13786 786367 65 65
WriteX 13786 786432 65471 65471
WriteX 13786 851903 65 65
WriteX 13786 851968 65471 65471
WriteX 13786 917439 65 65
WriteX 13786 917504 65471 65471
WriteX 13786 982975 65 65
WriteX 13786 983040 65471 65471
WriteX 13786 1048511 65 65
Close 13786
NTCreateX \clients\client1\filler.001 0x40 0x2 13787
WriteX 13787 65534 1 1
QUERY_FILE_INFORMATION 13787
WriteX 13787 0 65471 65471
WriteX 13787 65471 65 65
WriteX 13787 65536 65471 65471
WriteX 13787 131007 65 65
WriteX 13787 131072 65471 65471
WriteX 13787 196543 65 65
WriteX 13787 196608 65471 65471
WriteX 13787 262079 65 65
WriteX 13787 262144 65471 65471
WriteX 13787 327615 65 65
WriteX 13787 327680 65471 65471
WriteX 13787 393151 65 65
WriteX 13787 393216 65471 65471
WriteX 13787 458687 65 65
WriteX 13787 458752 65471 65471
WriteX 13787 524223 65 65
WriteX 13787 524288 65471 65471
WriteX 13787 589759 65 65
WriteX 13787 589824 65471 65471
WriteX 13787 655295 65 65
WriteX 13787 655360 65471 65471
WriteX 13787 720831 65 65
WriteX 13787 720896 65471 65471
WriteX 13787 786367 65 65
WriteX 13787 786432 65471 65471
WriteX 13787 851903 65 65
WriteX 13787 851968 65471 65471
WriteX 13787 917439 65 65
WriteX 13787 917504 65471 65471
WriteX 13787 982975 65 65
WriteX 13787 983040 65471 65471
WriteX 13787 1048511 65 65
Close 13787
NTCreateX \clients\client1\filler.002 0x40 0x2 13788
WriteX 13788 65534 1 1
QUERY_FILE_INFORMATION 13788
WriteX 13788 0 65471 65471
WriteX 13788 65471 65 65
WriteX 13788 65536 65471 65471
WriteX 13788 131007 65 65
WriteX 13788 131072 65471 65471
WriteX 13788 196543 65 65
WriteX 13788 196608 65471 65471
WriteX 13788 262079 65 65
WriteX 13788 262144 65471 65471
WriteX 13788 327615 65 65
WriteX 13788 327680 65471 65471
WriteX 13788 393151 65 65
WriteX 13788 393216 65471 65471
WriteX 13788 458687 65 65
WriteX 13788 458752 65471 65471
WriteX 13788 524223 65 65
WriteX 13788 524288 65471 65471
WriteX 13788 589759 65 65
WriteX 13788 589824 65471 65471
WriteX 13788 655295 65 65
WriteX 13788 655360 65471 65471
WriteX 13788 720831 65 65
WriteX 13788 720896 65471 65471
WriteX 13788 786367 65 65
WriteX 13788 786432 65471 65471
WriteX 13788 851903 65 65
WriteX 13788 851968 65471 65471
WriteX 13788 917439 65 65
WriteX 13788 917504 65471 65471
WriteX 13788 982975 65 65
WriteX 13788 983040 65471 65471
WriteX 13788 1048511 65 65
Close 13788
NTCreateX \clients\client1\filler.003 0x40 0x2 13789
WriteX 13789 65534 1 1
QUERY_FILE_INFORMATION 13789
WriteX 13789 0 65471 65471
WriteX 13789 65471 65 65
WriteX 13789 65536 65471 65471
WriteX 13789 131007 65 65
WriteX 13789 131072 65471 65471
WriteX 13789 196543 65 65
WriteX 13789 196608 65471 65471
WriteX 13789 262079 65 65
WriteX 13789 262144 65471 65471
WriteX 13789 327615 65 65
WriteX 13789 327680 65471 65471
WriteX 13789 393151 65 65
WriteX 13789 393216 65471 65471
WriteX 13789 458687 65 65
WriteX 13789 458752 65471 65471
WriteX 13789 524223 65 65
WriteX 13789 524288 65471 65471
WriteX 13789 589759 65 65
WriteX 13789 589824 65471 65471
WriteX 13789 655295 65 65
WriteX 13789 655360 65471 65471
WriteX 13789 720831 65 65
WriteX 13789 720896 65471 65471
WriteX 13789 786367 65 65
WriteX 13789 786432 65471 65471
WriteX 13789 851903 65 65
WriteX 13789 851968 65471 65471
WriteX 13789 917439 65 65
WriteX 13789 917504 65471 65471
WriteX 13789 982975 65 65
WriteX 13789 983040 65471 65471
WriteX 13789 1048511 65 65
Close 13789
NTCreateX \clients\client1\filler.004 0x40 0x2 13790
WriteX 13790 65534 1 1
QUERY_FILE_INFORMATION 13790
WriteX 13790 0 65471 65471
WriteX 13790 65471 65 65
WriteX 13790 65536 65471 65471
WriteX 13790 131007 65 65
WriteX 13790 131072 65471 65471
WriteX 13790 196543 65 65
WriteX 13790 196608 65471 65471
WriteX 13790 262079 65 65
WriteX 13790 262144 65471 65471
WriteX 13790 327615 65 65
WriteX 13790 327680 65471 65471
WriteX 13790 393151 65 65
WriteX 13790 393216 65471 65471
WriteX 13790 458687 65 65
WriteX 13790 458752 65471 65471
WriteX 13790 524223 65 65
WriteX 13790 524288 65471 65471
WriteX 13790 589759 65 65
WriteX 13790 589824 65471 65471
WriteX 13790 655295 65 65
WriteX 13790 655360 65471 65471
WriteX 13790 720831 65 65
WriteX 13790 720896 65471 65471
WriteX 13790 786367 65 65
WriteX 13790 786432 65471 65471
WriteX 13790 851903 65 65
WriteX 13790 851968 65471 65471
WriteX 13790 917439 65 65
WriteX 13790 917504 65471 65471
WriteX 13790 982975 65 65
WriteX 13790 983040 65471 65471
WriteX 13790 1048511 65 65
Close 13790
NTCreateX \clients\client1\~dmtmp\WORD 0x1 0x2 13791
Close 13791
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x2 13792
WriteX 13792 65534 1 1
QUERY_FILE_INFORMATION 13792
WriteX 13792 0 65471 65471
WriteX 13792 65471 65 65
WriteX 13792 65536 65471 65471
WriteX 13792 131007 65 65
WriteX 13792 131072 65471 65471
WriteX 13792 196543 65 65
WriteX 13792 196608 63488 63488
Close 13792
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x2 13793
WriteX 13793 65534 1 1
QUERY_FILE_INFORMATION 13793
WriteX 13793 0 65471 65471
WriteX 13793 65471 65 65
WriteX 13793 65536 65471 65471
WriteX 13793 131007 65 65
WriteX 13793 131072 65471 65471
WriteX 13793 196543 65 65
WriteX 13793 196608 63488 63488
Close 13793
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x2 13794
WriteX 13794 65534 1 1
QUERY_FILE_INFORMATION 13794
WriteX 13794 0 65471 65471
WriteX 13794 65471 65 65
WriteX 13794 65536 65471 65471
WriteX 13794 131007 65 65
WriteX 13794 131072 65471 65471
WriteX 13794 196543 65 65
WriteX 13794 196608 63488 63488
Close 13794
NTCreateX \clients\client1\~dmtmp\EXCEL 0x1 0x2 13795
Close 13795
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x2 13796
WriteX 13796 65534 1 1
QUERY_FILE_INFORMATION 13796
WriteX 13796 0 65471 65471
WriteX 13796 65471 65 65
WriteX 13796 65536 65471 65471
WriteX 13796 131007 65 65
WriteX 13796 131072 65471 65471
WriteX 13796 196543 65 65
WriteX 13796 196608 63488 63488
Close 13796
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x2 13797
WriteX 13797 65534 1 1
QUERY_FILE_INFORMATION 13797
WriteX 13797 0 65471 65471
WriteX 13797 65471 65 65
WriteX 13797 65536 65471 65471
WriteX 13797 131007 65 65
WriteX 13797 131072 65471 65471
WriteX 13797 196543 65 65
WriteX 13797 196608 63488 63488
Close 13797
NTCreateX \clients\client1\~dmtmp\PWRPNT 0x1 0x2 13798
Close 13798
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x2 13799
WriteX 13799 65534 1 1
QUERY_FILE_INFORMATION 13799
WriteX 13799 0 65471 65471
WriteX 13799 65471 65 65
WriteX 13799 65536 65471 65471
WriteX 13799 131007 65 65
WriteX 13799 131072 65471 65471
WriteX 13799 196543 65 65
WriteX 13799 196608 63488 63488
Close 13799
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x2 13800
WriteX 13800 65534 1 1
QUERY_FILE_INFORMATION 13800
WriteX 13800 0 65471 65471
WriteX 13800 65471 65 65
WriteX 13800 65536 65471 65471
WriteX 13800 131007 65 65
WriteX 13800 131072 65471 65471
WriteX 13800 196543 65 65
WriteX 13800 196608 63488 63488
Close 13800
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x2 13801
WriteX 13801 65534 1 1
QUERY_FILE_INFORMATION 13801
WriteX 13801 0 65471 65471
WriteX 13801 65471 65 65
WriteX 13801 65536 65471 65471
WriteX 13801 131007 65 65
WriteX 13801 131072 65471 65471
WriteX 13801 196543 65 65
WriteX 13801 196608 63488 63488
Close 13801
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x2 13802
WriteX 13802 65534 1 1
QUERY_FILE_INFORMATION 13802
WriteX 13802 0 65471 65471
WriteX 13802 65471 65 65
WriteX 13802 65536 65471 65471
WriteX 13802 131007 65 65
WriteX 13802 131072 65471 65471
WriteX 13802 196543 65 65
WriteX 13802 196608 63488 63488
Close 13802
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x2 13803
WriteX 13803 65534 1 1
QUERY_FILE_INFORMATION 13803
WriteX 13803 0 65471 65471
WriteX 13803 65471 65 65
WriteX 13803 65536 65471 65471
WriteX 13803 131007 65 65
WriteX 13803 131072 65471 65471
WriteX 13803 196543 65 65
WriteX 13803 196608 63488 63488
Close 13803
NTCreateX \clients\client1\~dmtmp\COREL 0x1 0x2 13804
Close 13804
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x2 13805
WriteX 13805 65534 1 1
QUERY_FILE_INFORMATION 13805
WriteX 13805 0 65471 65471
WriteX 13805 65471 65 65
WriteX 13805 65536 65471 65471
WriteX 13805 131007 65 65
WriteX 13805 131072 65471 65471
WriteX 13805 196543 65 65
WriteX 13805 196608 63488 63488
Close 13805
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x2 13806
WriteX 13806 65534 1 1
QUERY_FILE_INFORMATION 13806
WriteX 13806 0 65471 65471
WriteX 13806 65471 65 65
WriteX 13806 65536 65471 65471
WriteX 13806 131007 65 65
WriteX 13806 131072 65471 65471
WriteX 13806 196543 65 65
WriteX 13806 196608 63488 63488
Close 13806
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x2 13807
WriteX 13807 65534 1 1
QUERY_FILE_INFORMATION 13807
WriteX 13807 0 65471 65471
WriteX 13807 65471 65 65
WriteX 13807 65536 65471 65471
WriteX 13807 131007 65 65
WriteX 13807 131072 65471 65471
WriteX 13807 196543 65 65
WriteX 13807 196608 63488 63488
Close 13807
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x2 13808
WriteX 13808 65534 1 1
QUERY_FILE_INFORMATION 13808
WriteX 13808 0 65471 65471
WriteX 13808 65471 65 65
WriteX 13808 65536 65471 65471
WriteX 13808 131007 65 65
WriteX 13808 131072 65471 65471
WriteX 13808 196543 65 65
WriteX 13808 196608 63488 63488
Close 13808
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x2 13809
WriteX 13809 65534 1 1
QUERY_FILE_INFORMATION 13809
WriteX 13809 0 65471 65471
WriteX 13809 65471 65 65
WriteX 13809 65536 65471 65471
WriteX 13809 131007 65 65
WriteX 13809 131072 65471 65471
WriteX 13809 196543 65 65
WriteX 13809 196608 63488 63488
Close 13809
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x2 13810
WriteX 13810 65534 1 1
QUERY_FILE_INFORMATION 13810
WriteX 13810 0 65471 65471
WriteX 13810 65471 65 65
WriteX 13810 65536 65471 65471
WriteX 13810 131007 65 65
WriteX 13810 131072 65471 65471
WriteX 13810 196543 65 65
WriteX 13810 196608 63488 63488
Close 13810
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x2 13811
WriteX 13811 65534 1 1
QUERY_FILE_INFORMATION 13811
WriteX 13811 0 65471 65471
WriteX 13811 65471 65 65
WriteX 13811 65536 65471 65471
WriteX 13811 131007 65 65
WriteX 13811 131072 65471 65471
WriteX 13811 196543 65 65
WriteX 13811 196608 63488 63488
Close 13811
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x2 13812
WriteX 13812 65534 1 1
QUERY_FILE_INFORMATION 13812
WriteX 13812 0 65471 65471
WriteX 13812 65471 65 65
WriteX 13812 65536 65471 65471
WriteX 13812 131007 65 65
WriteX 13812 131072 65471 65471
WriteX 13812 196543 65 65
WriteX 13812 196608 63488 63488
Close 13812
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x2 13813
WriteX 13813 65534 1 1
QUERY_FILE_INFORMATION 13813
WriteX 13813 0 65471 65471
WriteX 13813 65471 65 65
WriteX 13813 65536 65471 65471
WriteX 13813 131007 65 65
WriteX 13813 131072 65471 65471
WriteX 13813 196543 65 65
WriteX 13813 196608 63488 63488
Close 13813
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x2 13814
WriteX 13814 65534 1 1
QUERY_FILE_INFORMATION 13814
WriteX 13814 0 65471 65471
WriteX 13814 65471 65 65
WriteX 13814 65536 65471 65471
WriteX 13814 131007 65 65
WriteX 13814 131072 65471 65471
WriteX 13814 196543 65 65
WriteX 13814 196608 63488 63488
Close 13814
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x2 13815
WriteX 13815 65534 1 1
QUERY_FILE_INFORMATION 13815
WriteX 13815 0 65471 65471
WriteX 13815 65471 65 65
WriteX 13815 65536 65471 65471
WriteX 13815 131007 65 65
WriteX 13815 131072 65471 65471
WriteX 13815 196543 65 65
WriteX 13815 196608 63488 63488
Close 13815
NTCreateX \clients\client1\~dmtmp\WORDPRO 0x1 0x2 13816
Close 13816
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x2 13817
WriteX 13817 65534 1 1
QUERY_FILE_INFORMATION 13817
WriteX 13817 0 65471 65471
WriteX 13817 65471 65 65
WriteX 13817 65536 65471 65471
WriteX 13817 131007 65 65
WriteX 13817 131072 65471 65471
WriteX 13817 196543 65 65
WriteX 13817 196608 63488 63488
Close 13817
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x2 13818
WriteX 13818 65534 1 1
QUERY_FILE_INFORMATION 13818
WriteX 13818 0 65471 65471
WriteX 13818 65471 65 65
WriteX 13818 65536 65471 65471
WriteX 13818 131007 65 65
WriteX 13818 131072 65471 65471
WriteX 13818 196543 65 65
WriteX 13818 196608 63488 63488
Close 13818
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x2 13819
WriteX 13819 65534 1 1
QUERY_FILE_INFORMATION 13819
WriteX 13819 0 65471 65471
WriteX 13819 65471 65 65
WriteX 13819 65536 65471 65471
WriteX 13819 131007 65 65
WriteX 13819 131072 65471 65471
WriteX 13819 196543 65 65
WriteX 13819 196608 63488 63488
Close 13819
NTCreateX \clients\client1\~dmtmp\PM 0x1 0x2 13820
Close 13820
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x2 13821
WriteX 13821 65534 1 1
QUERY_FILE_INFORMATION 13821
WriteX 13821 0 65471 65471
WriteX 13821 65471 65 65
WriteX 13821 65536 65471 65471
WriteX 13821 131007 65 65
WriteX 13821 131072 65471 65471
WriteX 13821 196543 65 65
WriteX 13821 196608 63488 63488
Close 13821
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x2 13822
WriteX 13822 65534 1 1
QUERY_FILE_INFORMATION 13822
WriteX 13822 0 65471 65471
WriteX 13822 65471 65 65
WriteX 13822 65536 65471 65471
WriteX 13822 131007 65 65
WriteX 13822 131072 65471 65471
WriteX 13822 196543 65 65
WriteX 13822 196608 63488 63488
Close 13822
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x2 13823
WriteX 13823 65534 1 1
QUERY_FILE_INFORMATION 13823
WriteX 13823 0 65471 65471
WriteX 13823 65471 65 65
WriteX 13823 65536 65471 65471
WriteX 13823 131007 65 65
WriteX 13823 131072 65471 65471
WriteX 13823 196543 65 65
WriteX 13823 196608 63488 63488
Close 13823
NTCreateX \clients\client1\~dmtmp\PARADOX 0x1 0x2 13824
Close 13824
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x2 13825
WriteX 13825 65534 1 1
QUERY_FILE_INFORMATION 13825
WriteX 13825 0 65471 65471
WriteX 13825 65471 65 65
WriteX 13825 65536 65471 65471
WriteX 13825 131007 65 65
WriteX 13825 131072 65471 65471
WriteX 13825 196543 65 65
WriteX 13825 196608 63488 63488
Close 13825
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x2 13826
WriteX 13826 65534 1 1
QUERY_FILE_INFORMATION 13826
WriteX 13826 0 65471 65471
WriteX 13826 65471 65 65
WriteX 13826 65536 65471 65471
WriteX 13826 131007 65 65
WriteX 13826 131072 65471 65471
WriteX 13826 196543 65 65
WriteX 13826 196608 63488 63488
Close 13826
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x2 13827
WriteX 13827 65534 1 1
QUERY_FILE_INFORMATION 13827
WriteX 13827 0 65471 65471
WriteX 13827 65471 65 65
WriteX 13827 65536 65471 65471
WriteX 13827 131007 65 65
WriteX 13827 131072 65471 65471
WriteX 13827 196543 65 65
WriteX 13827 196608 63488 63488
Close 13827
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x2 13828
WriteX 13828 65534 1 1
QUERY_FILE_INFORMATION 13828
WriteX 13828 0 65471 65471
WriteX 13828 65471 65 65
WriteX 13828 65536 65471 65471
WriteX 13828 131007 65 65
WriteX 13828 131072 65471 65471
WriteX 13828 196543 65 65
WriteX 13828 196608 63488 63488
Close 13828
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x2 13829
WriteX 13829 65534 1 1
QUERY_FILE_INFORMATION 13829
WriteX 13829 0 65471 65471
WriteX 13829 65471 65 65
WriteX 13829 65536 65471 65471
WriteX 13829 131007 65 65
WriteX 13829 131072 65471 65471
WriteX 13829 196543 65 65
WriteX 13829 196608 63488 63488
Close 13829
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x2 13830
WriteX 13830 65534 1 1
QUERY_FILE_INFORMATION 13830
WriteX 13830 0 65471 65471
WriteX 13830 65471 65 65
WriteX 13830 65536 65471 65471
WriteX 13830 131007 65 65
WriteX 13830 131072 65471 65471
WriteX 13830 196543 65 65
WriteX 13830 196608 63488 63488
Close 13830
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x2 13831
WriteX 13831 65534 1 1
QUERY_FILE_INFORMATION 13831
WriteX 13831 0 65471 65471
WriteX 13831 65471 65 65
WriteX 13831 65536 65471 65471
WriteX 13831 131007 65 65
WriteX 13831 131072 65471 65471
WriteX 13831 196543 65 65
WriteX 13831 196608 63488 63488
Close 13831
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x2 13832
WriteX 13832 65534 1 1
QUERY_FILE_INFORMATION 13832
WriteX 13832 0 65471 65471
WriteX 13832 65471 65 65
WriteX 13832 65536 65471 65471
WriteX 13832 131007 65 65
WriteX 13832 131072 65471 65471
WriteX 13832 196543 65 65
WriteX 13832 196608 63488 63488
Close 13832
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x2 13833
WriteX 13833 65534 1 1
QUERY_FILE_INFORMATION 13833
WriteX 13833 0 65471 65471
WriteX 13833 65471 65 65
WriteX 13833 65536 65471 65471
WriteX 13833 131007 65 65
WriteX 13833 131072 65471 65471
WriteX 13833 196543 65 65
WriteX 13833 196608 63488 63488
Close 13833
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x2 13834
WriteX 13834 65534 1 1
QUERY_FILE_INFORMATION 13834
WriteX 13834 0 65471 65471
WriteX 13834 65471 65 65
WriteX 13834 65536 65471 65471
WriteX 13834 131007 65 65
WriteX 13834 131072 65471 65471
WriteX 13834 196543 65 65
WriteX 13834 196608 63488 63488
Close 13834
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x2 13835
WriteX 13835 65534 1 1
QUERY_FILE_INFORMATION 13835
WriteX 13835 0 65471 65471
WriteX 13835 65471 65 65
WriteX 13835 65536 65471 65471
WriteX 13835 131007 65 65
WriteX 13835 131072 65471 65471
WriteX 13835 196543 65 65
WriteX 13835 196608 63488 63488
Close 13835
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x2 13836
WriteX 13836 65534 1 1
QUERY_FILE_INFORMATION 13836
WriteX 13836 0 65471 65471
WriteX 13836 65471 65 65
WriteX 13836 65536 65471 65471
WriteX 13836 131007 65 65
WriteX 13836 131072 65471 65471
WriteX 13836 196543 65 65
WriteX 13836 196608 63488 63488
Close 13836
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x2 13837
WriteX 13837 65534 1 1
QUERY_FILE_INFORMATION 13837
WriteX 13837 0 65471 65471
WriteX 13837 65471 65 65
WriteX 13837 65536 65471 65471
WriteX 13837 131007 65 65
WriteX 13837 131072 65471 65471
WriteX 13837 196543 65 65
WriteX 13837 196608 63488 63488
Close 13837
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x2 13838
WriteX 13838 65534 1 1
QUERY_FILE_INFORMATION 13838
WriteX 13838 0 65471 65471
WriteX 13838 65471 65 65
WriteX 13838 65536 65471 65471
WriteX 13838 131007 65 65
WriteX 13838 131072 65471 65471
WriteX 13838 196543 65 65
WriteX 13838 196608 63488 63488
Close 13838
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x2 13839
WriteX 13839 65534 1 1
QUERY_FILE_INFORMATION 13839
WriteX 13839 0 65471 65471
WriteX 13839 65471 65 65
WriteX 13839 65536 65471 65471
WriteX 13839 131007 65 65
WriteX 13839 131072 65471 65471
WriteX 13839 196543 65 65
WriteX 13839 196608 63488 63488
Close 13839
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x2 13840
WriteX 13840 65534 1 1
QUERY_FILE_INFORMATION 13840
WriteX 13840 0 65471 65471
WriteX 13840 65471 65 65
WriteX 13840 65536 65471 65471
WriteX 13840 131007 65 65
WriteX 13840 131072 65471 65471
WriteX 13840 196543 65 65
WriteX 13840 196608 63488 63488
Close 13840
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x2 13841
WriteX 13841 65534 1 1
QUERY_FILE_INFORMATION 13841
WriteX 13841 0 65471 65471
WriteX 13841 65471 65 65
WriteX 13841 65536 65471 65471
WriteX 13841 131007 65 65
WriteX 13841 131072 65471 65471
WriteX 13841 196543 65 65
WriteX 13841 196608 63488 63488
Close 13841
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x2 13842
WriteX 13842 65534 1 1
QUERY_FILE_INFORMATION 13842
WriteX 13842 0 65471 65471
WriteX 13842 65471 65 65
WriteX 13842 65536 65471 65471
WriteX 13842 131007 65 65
WriteX 13842 131072 65471 65471
WriteX 13842 196543 65 65
WriteX 13842 196608 63488 63488
Close 13842
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x2 13843
WriteX 13843 65534 1 1
QUERY_FILE_INFORMATION 13843
WriteX 13843 0 65471 65471
WriteX 13843 65471 65 65
WriteX 13843 65536 65471 65471
WriteX 13843 131007 65 65
WriteX 13843 131072 65471 65471
WriteX 13843 196543 65 65
WriteX 13843 196608 63488 63488
Close 13843
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x2 13844
WriteX 13844 65534 1 1
QUERY_FILE_INFORMATION 13844
WriteX 13844 0 65471 65471
WriteX 13844 65471 65 65
WriteX 13844 65536 65471 65471
WriteX 13844 131007 65 65
WriteX 13844 131072 65471 65471
WriteX 13844 196543 65 65
WriteX 13844 196608 63488 63488
Close 13844
NTCreateX \clients\client1\~dmtmp\ACCESS 0x1 0x2 13845
Close 13845
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x2 13846
WriteX 13846 65534 1 1
QUERY_FILE_INFORMATION 13846
WriteX 13846 0 65471 65471
WriteX 13846 65471 65 65
WriteX 13846 65536 65471 65471
WriteX 13846 131007 65 65
WriteX 13846 131072 65471 65471
WriteX 13846 196543 65 65
WriteX 13846 196608 63488 63488
Close 13846
NTCreateX \clients\client1\~dmtmp\SEED 0x1 0x2 13847
Close 13847
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x2 13848
WriteX 13848 65534 1 1
QUERY_FILE_INFORMATION 13848
WriteX 13848 0 65471 65471
WriteX 13848 65471 65 65
WriteX 13848 65536 65471 65471
WriteX 13848 131007 65 65
WriteX 13848 131072 65471 65471
WriteX 13848 196543 65 65
WriteX 13848 196608 65471 65471
WriteX 13848 262079 65 65
WriteX 13848 262144 65471 65471
WriteX 13848 327615 65 65
Close 13848
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x2 13849
WriteX 13849 65534 1 1
QUERY_FILE_INFORMATION 13849
WriteX 13849 0 65471 65471
WriteX 13849 65471 65 65
WriteX 13849 65536 65471 65471
WriteX 13849 131007 65 65
WriteX 13849 131072 65471 65471
WriteX 13849 196543 65 65
WriteX 13849 196608 65471 65471
WriteX 13849 262079 65 65
WriteX 13849 262144 65471 65471
WriteX 13849 327615 65 65
WriteX 13849 327680 65471 65471
WriteX 13849 393151 65 65
WriteX 13849 393216 65471 65471
WriteX 13849 458687 65 65
WriteX 13849 458752 65471 65471
WriteX 13849 524223 65 65
WriteX 13849 524288 65471 65471
WriteX 13849 589759 65 65
WriteX 13849 589824 65471 65471
WriteX 13849 655295 65 65
WriteX 13849 655360 65471 65471
WriteX 13849 720831 65 65
WriteX 13849 720896 65471 65471
WriteX 13849 786367 65 65
WriteX 13849 786432 65471 65471
WriteX 13849 851903 65 65
WriteX 13849 851968 65471 65471
WriteX 13849 917439 65 65
WriteX 13849 917504 65471 65471
WriteX 13849 982975 65 65
WriteX 13849 983040 65471 65471
WriteX 13849 1048511 65 65
Close 13849
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x2 13850
WriteX 13850 65534 1 1
QUERY_FILE_INFORMATION 13850
WriteX 13850 1114094 1 1
QUERY_FILE_INFORMATION 13850
WriteX 13850 0 65471 65471
WriteX 13850 65471 65 65
WriteX 13850 65536 65471 65471
WriteX 13850 131007 65 65
WriteX 13850 131072 65471 65471
WriteX 13850 196543 65 65
WriteX 13850 196608 65471 65471
WriteX 13850 262079 65 65
WriteX 13850 262144 65471 65471
WriteX 13850 327615 65 65
WriteX 13850 327680 65471 65471
WriteX 13850 393151 65 65
WriteX 13850 393216 65471 65471
WriteX 13850 458687 65 65
WriteX 13850 458752 65471 65471
WriteX 13850 524223 65 65
WriteX 13850 524288 65471 65471
WriteX 13850 589759 65 65
WriteX 13850 589824 65471 65471
WriteX 13850 655295 65 65
WriteX 13850 655360 65471 65471
WriteX 13850 720831 65 65
WriteX 13850 720896 65471 65471
WriteX 13850 786367 65 65
WriteX 13850 786432 65471 65471
WriteX 13850 851903 65 65
WriteX 13850 851968 65471 65471
WriteX 13850 917439 65 65
WriteX 13850 917504 65471 65471
WriteX 13850 982975 65 65
WriteX 13850 983040 65471 65471
WriteX 13850 1048511 65 65
WriteX 13850 1048576 65471 65471
WriteX 13850 1114047 65 65
WriteX 13850 1114112 65471 65471
WriteX 13850 1179583 65 65
WriteX 13850 1179648 65471 65471
WriteX 13850 1245119 65 65
WriteX 13850 1245184 65471 65471
WriteX 13850 1310655 65 65
WriteX 13850 1310720 65471 65471
WriteX 13850 1376191 65 65
WriteX 13850 1376256 65471 65471
WriteX 13850 1441727 65 65
WriteX 13850 1441792 65471 65471
WriteX 13850 1507263 65 65
WriteX 13850 1507328 65471 65471
WriteX 13850 1572799 65 65
WriteX 13850 1572864 65471 65471
WriteX 13850 1638335 65 65
WriteX 13850 1638400 65471 65471
WriteX 13850 1703871 65 65
WriteX 13850 1703936 65471 65471
WriteX 13850 1769407 65 65
WriteX 13850 1769472 65471 65471
WriteX 13850 1834943 65 65
WriteX 13850 1835008 32768 32768
Close 13850
QUERY_PATH_INFORMATION \clients\client1
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13851
ReadX 13851 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13852
Close 13852
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13853
WriteX 13853 63 1 1
QUERY_FILE_INFORMATION 13853
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13851 0 4096 4096
ReadX 13851 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13851 0 8192 8192
Flush 13851
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13851 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13851 0 8192 8192
Flush 13851
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13851 0 8192 8192
Flush 13851
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13851 0 8192 8192
Flush 13851
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13855
Close 13855
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13857
WriteX 13857 4065 1 1
QUERY_FILE_INFORMATION 13857
WriteX 13857 0 62591 62591
Close 13857
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13859
Close 13859
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13861
WriteX 13861 4094 1 1
QUERY_FILE_INFORMATION 13861
WriteX 13861 0 10845 10845
Close 13861
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13863
Close 13863
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13865
WriteX 13865 4081 1 1
QUERY_FILE_INFORMATION 13865
WriteX 13865 0 30118 30118
Close 13865
WriteX 13851 0 4096 4096
Close 13851
WriteX 13853 0 64 64
Close 13853
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13866
ReadX 13866 61440 4096 4096
ReadX 13866 126976 4096 4096
WriteX 13866 0 65471 65471
WriteX 13866 65471 65 65
WriteX 13866 65536 65471 65471
WriteX 13866 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13867
ReadX 13867 61440 4096 4096
ReadX 13867 126976 4096 4096
ReadX 13867 192512 4096 4096
ReadX 13867 258048 4096 4096
WriteX 13867 0 65471 65471
WriteX 13867 65471 65 65
WriteX 13867 65536 65471 65471
WriteX 13867 131007 65 65
WriteX 13867 131072 65471 65471
WriteX 13867 196543 65 65
WriteX 13867 196608 65471 65471
WriteX 13867 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13868
ReadX 13868 61440 4096 4096
ReadX 13868 126976 4096 4096
ReadX 13868 192512 4096 4096
ReadX 13868 258048 4096 4096
ReadX 13868 323584 4096 4096
ReadX 13868 389120 4096 4096
ReadX 13868 454656 4096 4096
ReadX 13868 520192 4096 4096
WriteX 13868 0 65471 65471
WriteX 13868 65471 65 65
WriteX 13868 65536 65471 65471
WriteX 13868 131007 65 65
WriteX 13868 131072 65471 65471
WriteX 13868 196543 65 65
WriteX 13868 196608 65471 65471
WriteX 13868 262079 65 65
WriteX 13868 262144 65471 65471
WriteX 13868 327615 65 65
WriteX 13868 327680 65471 65471
WriteX 13868 393151 65 65
WriteX 13868 393216 65471 65471
WriteX 13868 458687 65 65
WriteX 13868 458752 65471 65471
WriteX 13868 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13869
Close 13869
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13866
Close 13867
Close 13868
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13870
ReadX 13870 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13871
ReadX 13871 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13872
ReadX 13872 0 4096 4096
ReadX 13872 4096 4096 4096
ReadX 13872 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13873
Close 13873
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13870
Close 13871
Close 13872
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13874
Close 13874
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13875
ReadX 13875 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13876
FIND_FIRST \clients\client1\~dmtmp\*
Close 13876
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13877
Close 13877
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13878
ReadX 13878 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13879
Close 13879
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13875
Close 13878
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13880
Close 13880
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13881
ReadX 13881 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13882
ReadX 13882 0 8192 8192
ReadX 13882 8192 8192 8192
ReadX 13882 16384 8192 8192
ReadX 13882 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13884
Close 13884
Close 13881
Close 13882
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13886
WriteX 13886 8191 1 1
QUERY_FILE_INFORMATION 13886
WriteX 13886 0 10438 10438
Close 13886
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13887
Close 13887
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13888
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13889
Close 13889
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13890
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13891
Close 13891
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13892
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13893
FIND_FIRST \clients\client1\~dmtmp\*
Close 13893
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13894
Close 13894
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13895
ReadX 13895 0 4096 4096
Close 13895
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13896
ReadX 13896 0 8192 8192
Close 13896
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13897
ReadX 13897 0 8192 8192
ReadX 13897 8192 4096 4096
ReadX 13897 12288 8192 8192
ReadX 13897 20480 8192 8192
ReadX 13897 28672 8192 8192
ReadX 13897 36864 8192 8192
ReadX 13897 45056 8192 8192
ReadX 13897 53248 8192 8192
ReadX 13897 61440 8192 8192
ReadX 13897 69632 8192 8192
ReadX 13897 77824 8192 8192
ReadX 13897 86016 8192 8192
ReadX 13897 94208 8192 8192
ReadX 13897 102400 8192 8192
ReadX 13897 110592 8192 8192
ReadX 13897 118784 8192 8192
ReadX 13897 126976 8192 8192
ReadX 13897 135168 8192 8192
ReadX 13897 143360 8192 8192
ReadX 13897 151552 8192 8192
ReadX 13897 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13898
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13898
Close 13897
Close 13888
Close 13890
Close 13892
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13899
Close 13899
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13901
WriteX 13901 8191 1 1
QUERY_FILE_INFORMATION 13901
WriteX 13901 0 28489 28489
Close 13901
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13902
Close 13902
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13903
FIND_FIRST \clients\client1\~dmtmp\*
Close 13903
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13904
Close 13904
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13905
ReadX 13905 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13906
Close 13906
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13905
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13907
Close 13907
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13908
ReadX 13908 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13909
ReadX 13909 0 8192 8192
ReadX 13909 8192 8192 8192
ReadX 13909 16384 8192 8192
ReadX 13909 24576 8192 8192
ReadX 13909 32768 16384 16384
ReadX 13909 49152 8192 8192
ReadX 13909 57344 8192 8192
ReadX 13909 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13911
Close 13911
Close 13908
Close 13909
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13913
WriteX 13913 8191 1 1
QUERY_FILE_INFORMATION 13913
WriteX 13913 0 29253 29253
Close 13913
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13914
Close 13914
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13915
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13916
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13916
Close 13915
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13917
Close 13917
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13919
WriteX 13919 8191 1 1
QUERY_FILE_INFORMATION 13919
WriteX 13919 0 30183 30183
Close 13919
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13920
Close 13920
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13921
WriteX 13921 0 510 510
WriteX 13921 510 512 512
WriteX 13921 1022 510 510
WriteX 13921 1532 510 510
WriteX 13921 2042 168 168
Close 13921
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13922
Close 13922
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13923
ReadX 13923 0 4096 4096
WriteX 13923 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13924
ReadX 13924 0 65471 65471
ReadX 13924 65471 65 65
ReadX 13924 65536 65471 65471
ReadX 13924 131007 65 65
ReadX 13924 131072 65471 65471
ReadX 13924 196543 65 65
ReadX 13924 196608 65471 65471
ReadX 13924 262079 65 65
ReadX 13924 262144 65471 65471
ReadX 13924 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13925
ReadX 13925 0 65471 65471
ReadX 13925 65471 65 65
ReadX 13925 65536 65471 65471
ReadX 13925 131007 65 65
ReadX 13925 131072 65471 65471
ReadX 13925 196543 65 65
ReadX 13925 196608 65471 65471
ReadX 13925 262079 65 65
ReadX 13925 262144 65471 65471
ReadX 13925 327615 65 65
ReadX 13925 327680 65471 65471
ReadX 13925 393151 65 65
ReadX 13925 393216 65471 65471
ReadX 13925 458687 65 65
ReadX 13925 458752 65471 65471
ReadX 13925 524223 65 65
ReadX 13925 524288 65471 65471
ReadX 13925 589759 65 65
ReadX 13925 589824 65471 65471
ReadX 13925 655295 65 65
ReadX 13925 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13926
ReadX 13926 0 65471 65471
ReadX 13926 65471 65 65
ReadX 13926 65536 65471 65471
ReadX 13926 131007 65 65
ReadX 13926 131072 65471 65471
ReadX 13926 196543 65 65
ReadX 13926 196608 65471 65471
ReadX 13926 262079 65 65
ReadX 13926 262144 65471 65471
ReadX 13926 327615 65 65
ReadX 13926 327680 65471 65471
ReadX 13926 393151 65 65
ReadX 13926 393216 65471 65471
ReadX 13926 458687 65 65
ReadX 13926 458752 65471 65471
ReadX 13926 524223 65 65
ReadX 13926 524288 65471 65471
ReadX 13926 589759 65 65
ReadX 13926 589824 65471 65471
ReadX 13926 655295 65 65
ReadX 13926 655360 65471 65471
ReadX 13926 720831 65 65
ReadX 13926 720896 65471 65471
ReadX 13926 786367 65 65
ReadX 13926 786432 65471 65471
ReadX 13926 851903 65 65
ReadX 13926 851968 65471 65471
ReadX 13926 917439 65 65
ReadX 13926 917504 65471 65471
ReadX 13926 982975 65 65
ReadX 13926 983040 65471 65471
ReadX 13926 1048511 65 65
ReadX 13926 1048576 65471 65471
ReadX 13926 1114047 65 65
ReadX 13926 1114112 65471 65471
ReadX 13926 1179583 65 65
ReadX 13926 1179648 65471 65471
ReadX 13926 1245119 65 65
ReadX 13926 1245184 65471 65471
ReadX 13926 1310655 65 65
ReadX 13926 1310720 65471 65471
ReadX 13926 1376191 65 65
ReadX 13926 1376256 65471 65471
ReadX 13926 1441727 65 65
ReadX 13926 1441792 65471 65471
ReadX 13926 1507263 65 65
ReadX 13926 1507328 65471 65471
ReadX 13926 1572799 65 65
ReadX 13926 1572864 65471 65471
ReadX 13926 1638335 65 65
ReadX 13926 1638400 65471 65471
ReadX 13926 1703871 65 65
ReadX 13926 1703936 65471 65471
ReadX 13926 1769407 65 65
ReadX 13926 1769472 65471 65471
ReadX 13926 1834943 65 65
ReadX 13926 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13927
ReadX 13927 0 4096 4096
ReadX 13927 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13928
WriteX 13928 52 1 1
QUERY_FILE_INFORMATION 13928
WriteX 13928 0 53 53
Close 13928
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13929
Close 13929
Close 13923
Close 13924
Close 13925
Close 13926
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13927 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13930
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13927 0 4096 4096
ReadX 13927 4096 4096 4096
ReadX 13927 8192 4096 4096
ReadX 13927 12288 4096 4096
WriteX 13930 15359 1 1
QUERY_FILE_INFORMATION 13930
ReadX 13927 16384 4096 4096
ReadX 13927 20480 4096 4096
WriteX 13930 0 15360 15360
Close 13930
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13931
ReadX 13931 0 4096 4096
WriteX 13931 0 4096 4096
Close 13931
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13932
Close 13932
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13933
ReadX 13933 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13934
Close 13934
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13927
ReadX 13933 0 4096 4096
ReadX 13933 4096 4096 4096
ReadX 13933 8192 4096 4096
ReadX 13933 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13935
ReadX 13935 0 4096 4096
ReadX 13935 0 4096 4096
ReadX 13935 4096 4096 4096
ReadX 13935 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13936
ReadX 13936 0 4096 4096
ReadX 13936 4096 4096 4096
ReadX 13936 8192 4096 4096
Close 13935
Close 13936
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13937
WriteX 13937 15359 1 1
QUERY_FILE_INFORMATION 13937
WriteX 13937 0 15360 15360
Close 13937
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13938
ReadX 13938 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13933
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13939
Close 13939
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13940
ReadX 13940 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13941
Close 13941
WriteX 13938 0 4096 4096
Close 13938
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13942
Close 13942
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13943
ReadX 13943 0 4096 4096
ReadX 13943 0 4096 4096
ReadX 13943 4096 4096 4096
ReadX 13943 8192 4096 4096
ReadX 13943 12288 3072 3072
ReadX 13943 0 8192 8192
ReadX 13943 8192 4096 4096
ReadX 13943 12288 3072 3072
WriteX 13943 15469 1 1
QUERY_FILE_INFORMATION 13943
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13944
ReadX 13944 0 4096 4096
ReadX 13944 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13945
WriteX 13945 52 1 1
QUERY_FILE_INFORMATION 13945
WriteX 13945 0 53 53
Close 13945
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13946
Close 13946
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13944 0 8192 8192
ReadX 13944 8192 4096 4096
ReadX 13944 12288 4096 4096
WriteX 13947 12005 1 1
QUERY_FILE_INFORMATION 13947
WriteX 13947 0 12006 12006
Close 13947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13948
ReadX 13948 0 4096 4096
WriteX 13948 0 4096 4096
Close 13948
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13949
Close 13949
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13950
ReadX 13950 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13951
Close 13951
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13944
ReadX 13950 0 4096 4096
ReadX 13950 4096 4096 4096
ReadX 13950 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13952
WriteX 13952 11990 1 1
QUERY_FILE_INFORMATION 13952
WriteX 13952 0 11991 11991
Close 13952
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13953
ReadX 13953 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13950
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13954
Close 13954
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13955
ReadX 13955 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13956
Close 13956
WriteX 13953 0 4096 4096
Close 13953
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13957
Close 13957
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13958
ReadX 13958 0 4096 4096
ReadX 13958 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13959
Close 13959
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13958 0 8192 8192
ReadX 13958 8192 3799 3799
WriteX 13958 13247 1 1
QUERY_FILE_INFORMATION 13958
WriteX 13958 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13958 0 8192 8192
ReadX 13958 8192 4096 4096
Close 13940
WriteX 13943 0 19054 19054
Close 13943
WriteX 13958 0 12288 12288
Close 13958
Close 13955
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13960
Close 13960
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13961
Close 13961
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13962
ReadX 13962 61440 4096 4096
ReadX 13962 126976 4096 4096
WriteX 13962 0 65471 65471
WriteX 13962 65471 65 65
WriteX 13962 65536 65471 65471
WriteX 13962 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13963
ReadX 13963 61440 4096 4096
ReadX 13963 126976 4096 4096
ReadX 13963 192512 4096 4096
ReadX 13963 258048 4096 4096
WriteX 13963 0 65471 65471
WriteX 13963 65471 65 65
WriteX 13963 65536 65471 65471
WriteX 13963 131007 65 65
WriteX 13963 131072 65471 65471
WriteX 13963 196543 65 65
WriteX 13963 196608 65471 65471
WriteX 13963 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13964
ReadX 13964 61440 4096 4096
ReadX 13964 126976 4096 4096
ReadX 13964 192512 4096 4096
ReadX 13964 258048 4096 4096
ReadX 13964 323584 4096 4096
ReadX 13964 389120 4096 4096
ReadX 13964 454656 4096 4096
ReadX 13964 520192 4096 4096
WriteX 13964 0 65471 65471
WriteX 13964 65471 65 65
WriteX 13964 65536 65471 65471
WriteX 13964 131007 65 65
WriteX 13964 131072 65471 65471
WriteX 13964 196543 65 65
WriteX 13964 196608 65471 65471
WriteX 13964 262079 65 65
WriteX 13964 262144 65471 65471
WriteX 13964 327615 65 65
WriteX 13964 327680 65471 65471
WriteX 13964 393151 65 65
WriteX 13964 393216 65471 65471
WriteX 13964 458687 65 65
WriteX 13964 458752 65471 65471
WriteX 13964 524223 65 65
Close 13962
Close 13963
Close 13964
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13965
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13965 0 4096 4096
Close 13965
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13966
ReadX 13966 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13966
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13967
ReadX 13967 0 4096 4096
ReadX 13967 4096 4096 4096
ReadX 13967 8192 4096 4096
ReadX 13967 12288 4096 4096
ReadX 13967 16384 4096 4096
ReadX 13967 20480 4096 4096
ReadX 13967 24576 4096 4096
ReadX 13967 28672 4096 4096
ReadX 13967 32768 4096 4096
ReadX 13967 36864 4096 4096
ReadX 13967 40960 4096 4096
ReadX 13967 45056 4096 4096
ReadX 13967 49152 4096 4096
ReadX 13967 53248 4096 4096
ReadX 13967 57344 4096 4096
ReadX 13967 61440 4096 4096
ReadX 13967 65536 4096 4096
ReadX 13967 69632 4096 4096
ReadX 13967 73728 4096 4096
WriteX 13967 0 4096 4096
Close 13967
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13968
Close 13968
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13969
ReadX 13969 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13970
Close 13970
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13969
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13972
WriteX 13972 4607 1 1
QUERY_FILE_INFORMATION 13972
WriteX 13972 0 65471 65471
WriteX 13972 65471 65 65
WriteX 13972 65536 19979 19979
Close 13972
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13973
ReadX 13973 0 4096 4096
WriteX 13973 0 4096 4096
Flush 13973
WriteX 13973 0 4096 4096
Flush 13973
QUERY_FILE_INFORMATION 13973
WriteX 13973 0 4096 4096
Flush 13973
WriteX 13973 0 4096 4096
Flush 13973
WriteX 13973 0 4096 4096
Flush 13973
WriteX 13973 0 4096 4096
Flush 13973
Close 13973
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13974
ReadX 13974 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13975
ReadX 13975 0 4096 4096
Close 13974
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13976
ReadX 13976 0 4096 4096
Close 13976
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13977
ReadX 13977 0 4096 4096
Close 13977
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13978
ReadX 13978 0 4096 4096
WriteX 13978 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13979
Close 13979
Close 13975
Close 13978
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13980
Close 13980
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13982
WriteX 13982 4607 1 1
QUERY_FILE_INFORMATION 13982
WriteX 13982 0 65471 65471
WriteX 13982 65471 65 65
WriteX 13982 65536 17654 17654
Close 13982
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13983
ReadX 13983 0 4096 4096
WriteX 13983 0 4096 4096
Flush 13983
WriteX 13983 0 4096 4096
Flush 13983
QUERY_FILE_INFORMATION 13983
WriteX 13983 0 4096 4096
Flush 13983
WriteX 13983 0 4096 4096
Flush 13983
WriteX 13983 0 4096 4096
Flush 13983
WriteX 13983 0 4096 4096
Flush 13983
Close 13983
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13984
Close 13984
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13985
ReadX 13985 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13986
Close 13986
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13987
ReadX 13987 0 4096 4096
ReadX 13987 4096 4096 4096
ReadX 13987 8192 4096 4096
ReadX 13987 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13987 16384 4096 4096
ReadX 13987 20480 4096 4096
ReadX 13987 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13985
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13988
ReadX 13988 0 4096 4096
Close 13988
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13989
ReadX 13989 0 4096 4096
Close 13989
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13990
ReadX 13990 0 4096 4096
WriteX 13990 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13991
Close 13991
Close 13990
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13992
Close 13992
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13994
WriteX 13994 4607 1 1
QUERY_FILE_INFORMATION 13994
WriteX 13994 0 65471 65471
WriteX 13994 65471 65 65
WriteX 13994 65536 19490 19490
Close 13994
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13995
ReadX 13995 0 4096 4096
WriteX 13995 0 4096 4096
Flush 13995
WriteX 13995 0 4096 4096
Flush 13995
QUERY_FILE_INFORMATION 13995
WriteX 13995 0 4096 4096
Flush 13995
WriteX 13995 0 4096 4096
Flush 13995
WriteX 13995 0 4096 4096
Flush 13995
WriteX 13995 0 4096 4096
Flush 13995
Close 13995
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13996
Close 13996
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13997
ReadX 13997 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13998
Close 13998
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13997
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13999
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13999 0 4096 4096
Close 13999
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14000
ReadX 14000 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14000
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14001
ReadX 14001 0 4096 4096
ReadX 14001 4096 4096 4096
ReadX 14001 8192 4096 4096
ReadX 14001 12288 4096 4096
ReadX 14001 16384 4096 4096
ReadX 14001 20480 4096 4096
ReadX 14001 24576 4096 4096
ReadX 14001 28672 4096 4096
ReadX 14001 32768 4096 4096
ReadX 14001 36864 4096 4096
ReadX 14001 40960 4096 4096
ReadX 14001 45056 4096 4096
ReadX 14001 49152 4096 4096
ReadX 14001 53248 4096 4096
ReadX 14001 57344 4096 4096
ReadX 14001 61440 4096 4096
ReadX 14001 65536 4096 4096
ReadX 14001 69632 4096 4096
ReadX 14001 73728 4096 4096
WriteX 14001 0 4096 4096
Close 14001
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14002
Close 14002
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14003
ReadX 14003 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14004
Close 14004
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14003
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14006
WriteX 14006 4607 1 1
QUERY_FILE_INFORMATION 14006
WriteX 14006 0 65471 65471
WriteX 14006 65471 65 65
WriteX 14006 65536 8866 8866
Close 14006
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14007
ReadX 14007 0 4096 4096
WriteX 14007 0 4096 4096
Flush 14007
WriteX 14007 0 4096 4096
Flush 14007
Close 14007
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14008
ReadX 14008 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14008
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14009
ReadX 14009 0 4096 4096
Close 14009
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14010
ReadX 14010 0 4096 4096
Close 14010
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14011
ReadX 14011 0 4096 4096
WriteX 14011 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 14012
Close 14012
Close 14011
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 14013
Close 14013
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14015
WriteX 14015 4607 1 1
QUERY_FILE_INFORMATION 14015
WriteX 14015 0 65471 65471
WriteX 14015 65471 65 65
WriteX 14015 65536 9298 9298
Close 14015
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14016
ReadX 14016 0 4096 4096
WriteX 14016 0 4096 4096
Flush 14016
WriteX 14016 0 4096 4096
Flush 14016
Close 14016
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14017
Close 14017
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14018
ReadX 14018 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 14019
Close 14019
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 14021
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14021 0 4096 4096
Close 14021
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 14022
ReadX 14022 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14022 4096 4096 4096
ReadX 14022 8192 4096 4096
ReadX 14022 12288 4096 4096
ReadX 14022 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 14018
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14023
ReadX 14023 0 4096 4096
Close 14023
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14024
ReadX 14024 0 4096 4096
Close 14024
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14025
ReadX 14025 0 4096 4096
WriteX 14025 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 14026
Close 14026
Close 14022
Close 14025
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 14027
Close 14027
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14029
WriteX 14029 4607 1 1
QUERY_FILE_INFORMATION 14029
WriteX 14029 0 65471 65471
WriteX 14029 65471 65 65
WriteX 14029 65536 11540 11540
Close 14029
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14030
ReadX 14030 0 4096 4096
WriteX 14030 0 4096 4096
Flush 14030
WriteX 14030 0 4096 4096
Flush 14030
Close 14030
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14031
Close 14031
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14032
ReadX 14032 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 14033
Close 14033
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14032
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14034
ReadX 14034 0 65471 65471
ReadX 14034 65471 65 65
ReadX 14034 65536 65471 65471
ReadX 14034 131007 65 65
ReadX 14034 131072 65471 65471
ReadX 14034 196543 65 65
ReadX 14034 196608 65471 65471
ReadX 14034 262079 65 65
ReadX 14034 262144 65471 65471
ReadX 14034 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14035
ReadX 14035 0 65471 65471
ReadX 14035 65471 65 65
ReadX 14035 65536 65471 65471
ReadX 14035 131007 65 65
ReadX 14035 131072 65471 65471
ReadX 14035 196543 65 65
ReadX 14035 196608 65471 65471
ReadX 14035 262079 65 65
ReadX 14035 262144 65471 65471
ReadX 14035 327615 65 65
ReadX 14035 327680 65471 65471
ReadX 14035 393151 65 65
ReadX 14035 393216 65471 65471
ReadX 14035 458687 65 65
ReadX 14035 458752 65471 65471
ReadX 14035 524223 65 65
ReadX 14035 524288 65471 65471
ReadX 14035 589759 65 65
ReadX 14035 589824 65471 65471
ReadX 14035 655295 65 65
ReadX 14035 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14036
ReadX 14036 0 65471 65471
ReadX 14036 65471 65 65
ReadX 14036 65536 65471 65471
ReadX 14036 131007 65 65
ReadX 14036 131072 65471 65471
ReadX 14036 196543 65 65
ReadX 14036 196608 65471 65471
ReadX 14036 262079 65 65
ReadX 14036 262144 65471 65471
ReadX 14036 327615 65 65
ReadX 14036 327680 65471 65471
ReadX 14036 393151 65 65
ReadX 14036 393216 65471 65471
ReadX 14036 458687 65 65
ReadX 14036 458752 65471 65471
ReadX 14036 524223 65 65
ReadX 14036 524288 65471 65471
ReadX 14036 589759 65 65
ReadX 14036 589824 65471 65471
ReadX 14036 655295 65 65
ReadX 14036 655360 65471 65471
ReadX 14036 720831 65 65
ReadX 14036 720896 65471 65471
ReadX 14036 786367 65 65
ReadX 14036 786432 65471 65471
ReadX 14036 851903 65 65
ReadX 14036 851968 65471 65471
ReadX 14036 917439 65 65
ReadX 14036 917504 65471 65471
ReadX 14036 982975 65 65
ReadX 14036 983040 65471 65471
ReadX 14036 1048511 65 65
ReadX 14036 1048576 65471 65471
ReadX 14036 1114047 65 65
ReadX 14036 1114112 65471 65471
ReadX 14036 1179583 65 65
ReadX 14036 1179648 65471 65471
ReadX 14036 1245119 65 65
ReadX 14036 1245184 65471 65471
ReadX 14036 1310655 65 65
ReadX 14036 1310720 65471 65471
ReadX 14036 1376191 65 65
ReadX 14036 1376256 65471 65471
ReadX 14036 1441727 65 65
ReadX 14036 1441792 65471 65471
ReadX 14036 1507263 65 65
ReadX 14036 1507328 65471 65471
ReadX 14036 1572799 65 65
ReadX 14036 1572864 65471 65471
ReadX 14036 1638335 65 65
ReadX 14036 1638400 65471 65471
ReadX 14036 1703871 65 65
ReadX 14036 1703936 65471 65471
ReadX 14036 1769407 65 65
ReadX 14036 1769472 65471 65471
ReadX 14036 1834943 65 65
ReadX 14036 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 14037
FIND_FIRST \clients\client1\~dmtmp\*
Close 14037
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 14038
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 14039
QUERY_FILE_INFORMATION 14039
QUERY_FILE_INFORMATION 14039
QUERY_FILE_INFORMATION 14039
ReadX 14039 2156 24 24
ReadX 14039 2139 276 276
ReadX 14039 2136 14 14
ReadX 14039 2136 7 7
ReadX 14039 2138 12 12
ReadX 14039 2137 8 8
ReadX 14039 2135 15 15
ReadX 14039 0 16 16
ReadX 14039 16 2048 2048
ReadX 14039 2064 2048 2048
ReadX 14039 257 2048 2048
ReadX 14039 385 2048 2048
ReadX 14039 513 2048 2048
ReadX 14039 641 2048 2048
ReadX 14039 769 2048 2048
ReadX 14039 897 2048 2048
ReadX 14039 1025 2048 2048
ReadX 14039 1153 2048 2048
ReadX 14039 1281 2048 2048
ReadX 14039 1409 2048 2048
ReadX 14039 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 14041
Close 14041
Close 13987
Close 14034
Close 14035
Close 14036
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14043
WriteX 14043 15 1 1
QUERY_FILE_INFORMATION 14043
WriteX 14043 0 10575 10575
Flush 14043
Close 14043
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14044
Close 14044
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 14045
ReadX 14045 0 4096 4096
Close 14039
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14046
Close 14046
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14047
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14048
QUERY_FILE_INFORMATION 14048
ReadX 14048 0 512 512
ReadX 14048 512 512 512
ReadX 14048 1024 512 512
QUERY_FILE_INFORMATION 14048
QUERY_FILE_INFORMATION 14048
Close 14048
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14049
QUERY_FILE_INFORMATION 14049
ReadX 14049 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14050
QUERY_FILE_INFORMATION 14050
ReadX 14050 0 512 512
ReadX 14050 512 512 512
ReadX 14050 1024 512 512
ReadX 14050 288 20 20
ReadX 14050 308 2084 2084
ReadX 14050 388 2084 2084
ReadX 14050 388 2084 2084
ReadX 14038 2157 1386 1386
ReadX 14050 2472 399 399
ReadX 14050 3072 1536 1536
ReadX 14050 544 149 149
ReadX 14050 693 485 485
Close 14050
ReadX 14038 2157 4096 4096
ReadX 14038 6253 4096 4096
ReadX 14038 10349 4096 4096
ReadX 14038 14445 4096 4096
ReadX 14038 18541 4096 4096
ReadX 14038 22637 256 256
ReadX 14038 22893 4096 4096
ReadX 14038 26989 4096 4096
ReadX 14038 31085 4096 4096
ReadX 14038 35181 4096 4096
ReadX 14038 39277 4096 4096
ReadX 14038 43373 4096 4096
ReadX 14038 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 14038 2157 1024 1024
ReadX 14038 1667 4688 4688
ReadX 14038 6355 3516 3516
ReadX 14038 9871 16384 16384
ReadX 14038 26255 3771 3771
ReadX 14038 30026 2048 2048
ReadX 14038 32074 1024 1024
ReadX 14038 33098 6652 6652
ReadX 14038 39750 16384 16384
ReadX 14038 56134 10496 10496
ReadX 14038 66630 1784 1784
ReadX 14038 68414 90 90
ReadX 14038 68504 273 273
ReadX 14038 68777 1600 1600
ReadX 14038 70377 640 640
ReadX 14038 71017 1280 1280
ReadX 14038 72297 8464 8464
ReadX 14038 80761 158 158
ReadX 14038 80919 912 912
ReadX 14038 81831 1980 1980
ReadX 14038 83811 2256 2256
ReadX 14038 86067 400 400
ReadX 14038 86467 252 252
ReadX 14038 86719 42 42
ReadX 14038 86761 725 725
ReadX 14038 2009 512 512
ReadX 14038 3895 9 9
ReadX 14038 3781 46 46
ReadX 14038 4059 92 92
ReadX 14038 3781 92 92
ReadX 14038 3986 184 184
ReadX 14038 3987 16384 16384
ReadX 14038 3902 16384 16384
ReadX 14038 3781 10240 10240
ReadX 14038 3821 16384 16384
ReadX 14038 3891 935 935
ReadX 14038 4060 10240 10240
ReadX 14038 4059 184 184
ReadX 14038 256 184 184
ReadX 14038 256 1026 1026
ReadX 14038 3901 326 326
ReadX 14038 3899 652 652
ReadX 14038 256 2 2
ReadX 14038 258 4948 4948
Close 14038
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 14052
Close 14052
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 14054
WriteX 14054 4055 1 1
QUERY_FILE_INFORMATION 14054
WriteX 14054 0 65471 65471
WriteX 14054 65471 65 65
WriteX 14054 65536 65471 65471
WriteX 14054 131007 65 65
WriteX 14054 131072 65471 65471
WriteX 14054 196543 65 65
WriteX 14054 196608 65471 65471
WriteX 14054 262079 65 65
WriteX 14054 262144 65471 65471
WriteX 14054 327615 65 65
WriteX 14054 327680 65471 65471
WriteX 14054 393151 65 65
WriteX 14054 393216 65471 65471
WriteX 14054 458687 65 65
WriteX 14054 458752 65471 65471
WriteX 14054 524223 65 65
WriteX 14054 524288 65471 65471
WriteX 14054 589759 65 65
WriteX 14054 589824 35257 35257
Close 14054
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 14056
Close 14056
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 14058
WriteX 14058 4055 1 1
QUERY_FILE_INFORMATION 14058
WriteX 14058 0 65471 65471
WriteX 14058 65471 65 65
WriteX 14058 65536 65471 65471
WriteX 14058 131007 65 65
WriteX 14058 131072 65471 65471
WriteX 14058 196543 65 65
WriteX 14058 196608 65471 65471
WriteX 14058 262079 65 65
WriteX 14058 262144 65471 65471
WriteX 14058 327615 65 65
WriteX 14058 327680 65471 65471
WriteX 14058 393151 65 65
WriteX 14058 393216 65471 65471
WriteX 14058 458687 65 65
WriteX 14058 458752 65471 65471
WriteX 14058 524223 65 65
WriteX 14058 524288 65471 65471
WriteX 14058 589759 65 65
WriteX 14058 589824 57598 57598
Close 14058
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14060
WriteX 14060 15 1 1
QUERY_FILE_INFORMATION 14060
WriteX 14060 0 12543 12543
Flush 14060
Close 14060
Close 14045
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14061
Close 14061
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 14062
ReadX 14062 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 14063
FIND_FIRST \clients\client1\~dmtmp\*
Close 14063
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 14064
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 14065
QUERY_FILE_INFORMATION 14065
QUERY_FILE_INFORMATION 14065
QUERY_FILE_INFORMATION 14065
ReadX 14065 1938 24 24
ReadX 14065 1920 276 276
ReadX 14065 1918 14 14
ReadX 14065 1918 7 7
ReadX 14065 1919 12 12
ReadX 14065 1919 8 8
ReadX 14065 1917 15 15
ReadX 14065 0 16 16
ReadX 14065 16 2048 2048
ReadX 14065 2064 2048 2048
ReadX 14065 257 2048 2048
ReadX 14065 385 2048 2048
ReadX 14065 513 2048 2048
ReadX 14065 641 2048 2048
ReadX 14065 769 2048 2048
ReadX 14065 897 2048 2048
ReadX 14065 1025 2048 2048
ReadX 14065 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 14067
Close 14067
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14069
WriteX 14069 15 1 1
QUERY_FILE_INFORMATION 14069
WriteX 14069 0 11588 11588
Flush 14069
Close 14069
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14070
Close 14070
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 14071
ReadX 14071 0 4096 4096
Close 14065
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14073
WriteX 14073 15 1 1
QUERY_FILE_INFORMATION 14073
WriteX 14073 0 11615 11615
Flush 14073
Close 14073
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 14071
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14074
Close 14074
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 14075
ReadX 14075 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 14077
Close 14077
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 14079
WriteX 14079 4088 1 1
QUERY_FILE_INFORMATION 14079
WriteX 14079 0 65471 65471
WriteX 14079 65471 65 65
WriteX 14079 65536 16050 16050
Close 14079
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14064 1939 64 64
ReadX 14064 128 248 248
ReadX 14064 128 568 568
ReadX 14064 3872 1536 1536
ReadX 14064 3456 2560 2560
ReadX 14064 3136 512 512
ReadX 14064 2880 4096 4096
ReadX 14064 3264 3072 3072
ReadX 14064 320 4096 4096
ReadX 14064 1024 4096 4096
ReadX 14064 3616 4096 4096
ReadX 14064 1939 64 64
ReadX 14064 128 248 248
ReadX 14064 128 608 608
ReadX 14064 2858 1024 1024
ReadX 14064 2810 4096 4096
ReadX 14064 2826 4096 4096
ReadX 14064 2580 2048 2048
ReadX 14064 2800 2560 2560
ReadX 14064 2100 4096 4096
ReadX 14064 2084 4096 4096
ReadX 14064 868 4096 4096
ReadX 14064 2324 4096 4096
ReadX 14064 884 4096 4096
ReadX 14064 2604 1024 1024
ReadX 14064 580 4096 4096
ReadX 14064 596 4096 4096
ReadX 14064 2752 4096 4096
ReadX 14064 2842 1024 1024
ReadX 14064 660 4096 4096
ReadX 14064 2720 4096 4096
ReadX 14064 2736 4096 4096
ReadX 14064 628 4096 4096
ReadX 14064 2704 4096 4096
ReadX 14064 1556 4096 4096
ReadX 14064 576 4096 4096
ReadX 14064 3168 1536 1536
ReadX 14064 832 4096 4096
ReadX 14064 1088 4096 4096
ReadX 14064 1344 4096 4096
ReadX 14064 1600 4096 4096
ReadX 14064 1856 4096 4096
ReadX 14064 2112 4096 4096
ReadX 14064 1892 4096 4096
ReadX 14064 820 4096 4096
ReadX 14064 788 4096 4096
ReadX 14064 1604 4096 4096
ReadX 14064 3648 4096 4096
ReadX 14064 2608 4096 4096
ReadX 14064 548 4096 4096
ReadX 14064 740 4096 4096
ReadX 14064 1344 4096 4096
ReadX 14064 3392 4096 4096
ReadX 14064 3904 4096 4096
ReadX 14064 644 4096 4096
ReadX 14064 676 4096 4096
ReadX 14064 2688 4096 4096
ReadX 14064 320 4096 4096
ReadX 14064 900 4096 4096
ReadX 14064 1908 4096 4096
ReadX 14064 852 4096 4096
ReadX 14064 724 4096 4096
ReadX 14064 2292 4096 4096
ReadX 14064 612 4096 4096
ReadX 14064 388 4096 4096
ReadX 14064 2368 4096 4096
ReadX 14064 2624 4096 4096
ReadX 14064 500 4096 4096
ReadX 14064 356 4096 4096
ReadX 14064 1024 4096 4096
ReadX 14064 576 4096 4096
ReadX 14064 340 4096 4096
ReadX 14064 420 4096 4096
ReadX 14064 1600 4096 4096
ReadX 14064 404 4096 4096
ReadX 14064 1428 4096 4096
ReadX 14064 2656 4096 4096
ReadX 14064 2624 4096 4096
ReadX 14064 452 4096 4096
ReadX 14064 692 4096 4096
ReadX 14064 564 4096 4096
ReadX 14064 372 4096 4096
ReadX 14064 468 4096 4096
ReadX 14064 484 4096 4096
ReadX 14064 1088 4096 4096
ReadX 14064 1924 4096 4096
ReadX 14064 2768 4096 4096
ReadX 14064 832 4096 4096
ReadX 14064 836 4096 4096
ReadX 14064 1856 4096 4096
ReadX 14064 2640 4096 4096
ReadX 14064 436 4096 4096
ReadX 14064 1828 4096 4096
ReadX 14064 804 4096 4096
ReadX 14064 1860 4096 4096
ReadX 14064 1812 4096 4096
ReadX 14064 756 4096 4096
ReadX 14064 1636 4096 4096
ReadX 14064 772 4096 4096
ReadX 14064 2036 4096 4096
ReadX 14064 1220 4096 4096
ReadX 14064 1652 4096 4096
ReadX 14064 2588 4096 4096
ReadX 14064 916 4096 4096
ReadX 14064 260 4096 4096
ReadX 14064 932 4096 4096
ReadX 14064 2624 4096 4096
ReadX 14064 308 4096 4096
ReadX 14064 292 4096 4096
ReadX 14064 1140 4096 4096
ReadX 14064 276 4096 4096
ReadX 14064 2020 4096 4096
ReadX 14064 2880 4096 4096
ReadX 14064 516 4096 4096
ReadX 14064 1844 4096 4096
ReadX 14064 1124 4096 4096
ReadX 14064 3136 4096 4096
ReadX 14064 324 4096 4096
ReadX 14064 1156 4096 4096
ReadX 14064 1172 4096 4096
ReadX 14064 2112 4096 4096
ReadX 14064 2368 4096 4096
ReadX 14064 964 4096 4096
ReadX 14064 980 4096 4096
ReadX 14064 1012 4096 4096
ReadX 14064 532 4096 4096
ReadX 14064 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 14064 1620 4096 4096
ReadX 14064 1604 4096 4096
ReadX 14064 2116 4096 4096
ReadX 14064 2132 4096 4096
ReadX 14064 2148 4096 4096
ReadX 14064 2276 4096 4096
ReadX 14064 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 14081
Close 14081
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 14083
QUERY_FILE_INFORMATION 14047
Close 14047
WriteX 14083 4088 1 1
QUERY_FILE_INFORMATION 14083
QUERY_FILE_INFORMATION 14049
Close 14049
WriteX 14083 0 65471 65471
WriteX 14083 65471 65 65
WriteX 14083 65536 64850 64850
Close 14083
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14085
WriteX 14085 15 1 1
QUERY_FILE_INFORMATION 14085
ReadX 14064 2068 4096 4096
ReadX 14064 1588 4096 4096
ReadX 14064 1572 4096 4096
WriteX 14085 0 18630 18630
Flush 14085
Close 14085
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 14075
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14086
Close 14086
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 14087
ReadX 14087 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 14064 612 4096 4096
ReadX 14064 564 4096 4096
ReadX 14064 1876 4096 4096
ReadX 14064 628 4096 4096
ReadX 14064 740 4096 4096
ReadX 14064 724 4096 4096
ReadX 14064 644 4096 4096
ReadX 14064 2324 4096 4096
ReadX 14064 660 4096 4096
ReadX 14064 852 4096 4096
ReadX 14064 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 14064 2368 4096 4096
ReadX 14064 1024 4096 4096
ReadX 14064 320 4096 4096
ReadX 14064 580 4096 4096
ReadX 14064 3136 512 512
ReadX 14064 2880 4096 4096
Close 14064
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14088
ReadX 14088 61440 4096 4096
ReadX 14088 126976 4096 4096
WriteX 14088 0 65471 65471
WriteX 14088 65471 65 65
WriteX 14088 65536 65471 65471
WriteX 14088 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14089
ReadX 14089 61440 4096 4096
ReadX 14089 126976 4096 4096
ReadX 14089 192512 4096 4096
ReadX 14089 258048 4096 4096
WriteX 14089 0 65471 65471
WriteX 14089 65471 65 65
WriteX 14089 65536 65471 65471
WriteX 14089 131007 65 65
WriteX 14089 131072 65471 65471
WriteX 14089 196543 65 65
WriteX 14089 196608 65471 65471
WriteX 14089 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14090
ReadX 14090 61440 4096 4096
ReadX 14090 126976 4096 4096
ReadX 14090 192512 4096 4096
ReadX 14090 258048 4096 4096
ReadX 14090 323584 4096 4096
ReadX 14090 389120 4096 4096
ReadX 14090 454656 4096 4096
ReadX 14090 520192 4096 4096
WriteX 14090 0 65471 65471
WriteX 14090 65471 65 65
WriteX 14090 65536 65471 65471
WriteX 14090 131007 65 65
WriteX 14090 131072 65471 65471
WriteX 14090 196543 65 65
WriteX 14090 196608 65471 65471
WriteX 14090 262079 65 65
WriteX 14090 262144 65471 65471
WriteX 14090 327615 65 65
WriteX 14090 327680 65471 65471
WriteX 14090 393151 65 65
WriteX 14090 393216 65471 65471
WriteX 14090 458687 65 65
WriteX 14090 458752 65471 65471
WriteX 14090 524223 65 65
Close 14087
Close 14062
Close 14088
Close 14089
Close 14090
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14091
Close 14091
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14092
Close 14092
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14095
Close 14095
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13754
Close 13754
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13755
Close 13755
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13758
Close 13758
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13760
Close 13760
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13761
Close 13761
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13764
Close 13764
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13768
Close 13768
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13772
Close 13772
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13776
Close 13776
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13780
Close 13780
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13784
Close 13784
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13788
Close 13788
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13792
Close 13792
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13794
Close 13794
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13796
Close 13796
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13798
WriteX 13798 4095 1 1
QUERY_FILE_INFORMATION 13798
QUERY_FS_INFORMATION 259
WriteX 13798 0 65471 65471
WriteX 13798 65471 65 65
WriteX 13798 65536 65471 65471
WriteX 13798 131007 65 65
WriteX 13798 131072 65471 65471
WriteX 13798 196543 65 65
WriteX 13798 196608 65471 65471
WriteX 13798 262079 65 65
WriteX 13798 262144 26634 26634
Close 13798
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13803
Close 13803
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13804
Close 13804
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13805
ReadX 13805 0 4096 4096
Close 13805
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13806
ReadX 13806 0 4096 4096
ReadX 13806 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13807
Close 13807
Close 13806
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13810
Close 13810
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13812
Close 13812
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13813
Close 13813
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13816
Close 13816
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13818
Close 13818
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13819
Close 13819
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13822
Close 13822
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13826
Close 13826
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13830
Close 13830
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13834
Close 13834
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13838
Close 13838
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13842
Close 13842
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13845
Close 13845
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13849
Close 13849
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13853
Close 13853
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13855
Close 13855
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13856
Close 13856
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13865
Close 13865
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13866
FIND_FIRST \clients\client1\~dmtmp\*
Close 13866
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13867
Close 13867
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13868
ReadX 13868 0 4096 4096
Close 13868
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13869
ReadX 13869 0 4096 4096
Close 13869
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13870
ReadX 13870 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13880
Close 13880
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13881
FIND_FIRST \clients\client1\~dmtmp\*
Close 13881
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13882
Close 13882
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13883
ReadX 13883 0 4096 4096
Close 13883
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13884
ReadX 13884 0 4096 4096
Close 13884
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13885
ReadX 13885 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13886
ReadX 13886 0 65471 65471
ReadX 13886 65471 65 65
ReadX 13886 65536 65471 65471
ReadX 13886 131007 65 65
ReadX 13886 131072 65471 65471
ReadX 13886 196543 65 65
ReadX 13886 196608 65471 65471
ReadX 13886 262079 65 65
ReadX 13886 262144 65471 65471
ReadX 13886 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13887
ReadX 13887 0 65471 65471
ReadX 13887 65471 65 65
ReadX 13887 65536 65471 65471
ReadX 13887 131007 65 65
ReadX 13887 131072 65471 65471
ReadX 13887 196543 65 65
ReadX 13887 196608 65471 65471
ReadX 13887 262079 65 65
ReadX 13887 262144 65471 65471
ReadX 13887 327615 65 65
ReadX 13887 327680 65471 65471
ReadX 13887 393151 65 65
ReadX 13887 393216 65471 65471
ReadX 13887 458687 65 65
ReadX 13887 458752 65471 65471
ReadX 13887 524223 65 65
ReadX 13887 524288 65471 65471
ReadX 13887 589759 65 65
ReadX 13887 589824 65471 65471
ReadX 13887 655295 65 65
ReadX 13887 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13888
ReadX 13888 0 65471 65471
ReadX 13888 65471 65 65
ReadX 13888 65536 65471 65471
ReadX 13888 131007 65 65
ReadX 13888 131072 65471 65471
ReadX 13888 196543 65 65
ReadX 13888 196608 65471 65471
ReadX 13888 262079 65 65
ReadX 13888 262144 65471 65471
ReadX 13888 327615 65 65
ReadX 13888 327680 65471 65471
ReadX 13888 393151 65 65
ReadX 13888 393216 65471 65471
ReadX 13888 458687 65 65
ReadX 13888 458752 65471 65471
ReadX 13888 524223 65 65
ReadX 13888 524288 65471 65471
ReadX 13888 589759 65 65
ReadX 13888 589824 65471 65471
ReadX 13888 655295 65 65
ReadX 13888 655360 65471 65471
ReadX 13888 720831 65 65
ReadX 13888 720896 65471 65471
ReadX 13888 786367 65 65
ReadX 13888 786432 65471 65471
ReadX 13888 851903 65 65
ReadX 13888 851968 65471 65471
ReadX 13888 917439 65 65
ReadX 13888 917504 65471 65471
ReadX 13888 982975 65 65
ReadX 13888 983040 65471 65471
ReadX 13888 1048511 65 65
ReadX 13888 1048576 65471 65471
ReadX 13888 1114047 65 65
ReadX 13888 1114112 65471 65471
ReadX 13888 1179583 65 65
ReadX 13888 1179648 65471 65471
ReadX 13888 1245119 65 65
ReadX 13888 1245184 65471 65471
ReadX 13888 1310655 65 65
ReadX 13888 1310720 65471 65471
ReadX 13888 1376191 65 65
ReadX 13888 1376256 65471 65471
ReadX 13888 1441727 65 65
ReadX 13888 1441792 65471 65471
ReadX 13888 1507263 65 65
ReadX 13888 1507328 65471 65471
ReadX 13888 1572799 65 65
ReadX 13888 1572864 65471 65471
ReadX 13888 1638335 65 65
ReadX 13888 1638400 65471 65471
ReadX 13888 1703871 65 65
ReadX 13888 1703936 65471 65471
ReadX 13888 1769407 65 65
ReadX 13888 1769472 65471 65471
ReadX 13888 1834943 65 65
ReadX 13888 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13889
ReadX 13889 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13889 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13889 8192 4096 4096
ReadX 13889 12288 4096 4096
ReadX 13889 16384 4096 4096
ReadX 13889 20480 4096 4096
ReadX 13889 24576 4096 4096
ReadX 13889 28672 4096 4096
ReadX 13889 32768 4096 4096
ReadX 13889 36864 4096 4096
ReadX 13889 40960 4096 4096
ReadX 13889 45056 4096 4096
ReadX 13889 49152 4096 4096
ReadX 13889 53248 4096 4096
ReadX 13889 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13889 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13890
Close 13890
Close 13870
Close 13885
Close 13886
Close 13887
Close 13888
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13891
WriteX 13891 1535 1 1
QUERY_FILE_INFORMATION 13891
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13889 0 4096 4096
ReadX 13889 4096 4096 4096
QUERY_FILE_INFORMATION 13891
WriteX 13891 0 57088 57088
WriteX 13891 0 4096 4096
Flush 13891
Close 13889
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13892
Close 13892
WriteX 13891 0 4096 4096
Close 13891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13893
Close 13893
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13894
ReadX 13894 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13894 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13895
WriteX 13895 1535 1 1
QUERY_FILE_INFORMATION 13895
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13894 0 4096 4096
QUERY_FILE_INFORMATION 13895
WriteX 13895 0 51456 51456
WriteX 13895 0 4096 4096
Flush 13895
Close 13894
WriteX 13895 0 4096 4096
Close 13895
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13896
Close 13896
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13897
ReadX 13897 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13897 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13899
Close 13899
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13901
WriteX 13901 4045 1 1
QUERY_FILE_INFORMATION 13901
WriteX 13901 0 53077 53077
Close 13901
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13902
WriteX 13902 1535 1 1
QUERY_FILE_INFORMATION 13902
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13897 0 4096 4096
QUERY_FILE_INFORMATION 13902
WriteX 13902 0 65471 65471
WriteX 13902 65471 65 65
WriteX 13902 65536 1856 1856
WriteX 13902 0 4096 4096
Flush 13902
Close 13897
WriteX 13902 0 4096 4096
Close 13902
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13903
Close 13903
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13904
ReadX 13904 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13906
Close 13906
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13908
WriteX 13908 4076 1 1
QUERY_FILE_INFORMATION 13908
WriteX 13908 0 7983 7983
Close 13908
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13910
Close 13910
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13912
WriteX 13912 4095 1 1
QUERY_FILE_INFORMATION 13912
WriteX 13912 0 65471 65471
WriteX 13912 65471 65 65
WriteX 13912 65536 65471 65471
WriteX 13912 131007 65 65
WriteX 13912 131072 65471 65471
WriteX 13912 196543 65 65
WriteX 13912 196608 65471 65471
WriteX 13912 262079 65 65
WriteX 13912 262144 65471 65471
WriteX 13912 327615 65 65
WriteX 13912 327680 65471 65471
WriteX 13912 393151 65 65
WriteX 13912 393216 65471 65471
WriteX 13912 458687 65 65
WriteX 13912 458752 46731 46731
Close 13912
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13913
WriteX 13913 1535 1 1
QUERY_FILE_INFORMATION 13913
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13904 0 4096 4096
ReadX 13904 4096 4096 4096
QUERY_FILE_INFORMATION 13913
WriteX 13913 0 65471 65471
WriteX 13913 65471 65 65
WriteX 13913 65536 22848 22848
WriteX 13913 0 4096 4096
Flush 13913
Close 13904
WriteX 13913 0 4096 4096
Close 13913
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13914
Close 13914
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13915
ReadX 13915 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13915 4096 4096 4096
Close 13915
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13916
ReadX 13916 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13916 0 8192 8192
ReadX 13916 8192 4096 4096
ReadX 13916 12288 4096 4096
ReadX 13916 16384 4096 4096
ReadX 13916 20480 4096 4096
ReadX 13916 24576 4096 4096
ReadX 13916 28672 4096 4096
ReadX 13916 32768 4096 4096
ReadX 13916 36864 4096 4096
ReadX 13916 40960 4096 4096
ReadX 13916 45056 4096 4096
ReadX 13916 49152 4096 4096
ReadX 13916 53248 4096 4096
ReadX 13916 57344 4096 4096
ReadX 13916 61440 4096 4096
ReadX 13916 65536 4096 4096
ReadX 13916 69632 4096 4096
ReadX 13916 73728 4096 4096
ReadX 13916 77824 4096 4096
ReadX 13916 81920 4096 4096
ReadX 13916 86016 4096 4096
ReadX 13916 90112 4096 4096
ReadX 13916 94208 4096 4096
ReadX 13916 98304 4096 4096
ReadX 13916 102400 4096 4096
ReadX 13916 106496 4096 4096
ReadX 13916 110592 4096 4096
ReadX 13916 114688 4096 4096
ReadX 13916 118784 4096 4096
ReadX 13916 122880 4096 4096
ReadX 13916 126976 4096 4096
ReadX 13916 131072 4096 4096
ReadX 13916 135168 4096 4096
ReadX 13916 139264 4096 4096
ReadX 13916 143360 4096 4096
ReadX 13916 147456 4096 4096
ReadX 13916 151552 4096 4096
ReadX 13916 155648 4096 4096
ReadX 13916 159744 4096 4096
ReadX 13916 163840 4096 4096
ReadX 13916 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13916 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13917
Close 13917
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13918
WriteX 13918 2047 1 1
QUERY_FILE_INFORMATION 13918
Close 13916
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13919
Close 13919
WriteX 13918 0 42388 42388
Close 13918
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13920
Close 13920
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13921
ReadX 13921 0 4096 4096
ReadX 13921 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13922
WriteX 13922 2047 1 1
QUERY_FILE_INFORMATION 13922
Close 13921
WriteX 13922 0 42652 42652
Close 13922
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13923
Close 13923
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13924
ReadX 13924 0 4096 4096
ReadX 13924 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13926
Close 13926
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13928
WriteX 13928 4080 1 1
QUERY_FILE_INFORMATION 13928
WriteX 13928 0 65471 65471
WriteX 13928 65471 65 65
WriteX 13928 65536 49 49
Close 13928
Close 13924
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13929
ReadX 13929 61440 4096 4096
ReadX 13929 126976 4096 4096
WriteX 13929 0 65471 65471
WriteX 13929 65471 65 65
WriteX 13929 65536 65471 65471
WriteX 13929 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13930
ReadX 13930 61440 4096 4096
ReadX 13930 126976 4096 4096
ReadX 13930 192512 4096 4096
ReadX 13930 258048 4096 4096
WriteX 13930 0 65471 65471
WriteX 13930 65471 65 65
WriteX 13930 65536 65471 65471
WriteX 13930 131007 65 65
WriteX 13930 131072 65471 65471
WriteX 13930 196543 65 65
WriteX 13930 196608 65471 65471
WriteX 13930 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13931
ReadX 13931 61440 4096 4096
ReadX 13931 126976 4096 4096
ReadX 13931 192512 4096 4096
ReadX 13931 258048 4096 4096
ReadX 13931 323584 4096 4096
ReadX 13931 389120 4096 4096
ReadX 13931 454656 4096 4096
ReadX 13931 520192 4096 4096
WriteX 13931 0 65471 65471
WriteX 13931 65471 65 65
WriteX 13931 65536 65471 65471
WriteX 13931 131007 65 65
WriteX 13931 131072 65471 65471
WriteX 13931 196543 65 65
WriteX 13931 196608 65471 65471
WriteX 13931 262079 65 65
WriteX 13931 262144 65471 65471
WriteX 13931 327615 65 65
WriteX 13931 327680 65471 65471
WriteX 13931 393151 65 65
WriteX 13931 393216 65471 65471
WriteX 13931 458687 65 65
WriteX 13931 458752 65471 65471
WriteX 13931 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13932
FIND_FIRST \clients\client1\~dmtmp\*
Close 13932
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13933
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13933 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13934
ReadX 13934 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13935
ReadX 13935 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13936
ReadX 13936 0 4096 4096
ReadX 13933 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13933
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13937
ReadX 13937 0 4096 4096
ReadX 13937 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13938
FIND_FIRST \clients\client1\~dmtmp\*
Close 13938
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13939
QUERY_FILE_INFORMATION 13939
WriteX 13939 2047 1 1
QUERY_FILE_INFORMATION 13939
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13940
Close 13940
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13941
WriteX 13941 52 1 1
QUERY_FILE_INFORMATION 13941
WriteX 13941 0 491 491
Close 13941
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13942
ReadX 13942 0 491 491
WriteX 13939 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13937
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13943
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13943 0 4096 4096
ReadX 13943 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13945
Close 13945
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13946
WriteX 13946 52 1 1
QUERY_FILE_INFORMATION 13946
WriteX 13946 0 543 543
Close 13946
Close 13943
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13947
ReadX 13947 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13948
ReadX 13948 0 543 543
ReadX 13947 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13947
Close 13942
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13929
Close 13930
Close 13931
Close 13948
Close 13934
Close 13935
Close 13936
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13939
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13949
FIND_FIRST \clients\client1\~dmtmp\*
Close 13949
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13950
ReadX 13950 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13951
ReadX 13951 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13952
ReadX 13952 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13953
ReadX 13953 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13954
ReadX 13954 0 543 543
ReadX 13950 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13958
FIND_FIRST \clients\client1\~dmtmp\*
Close 13958
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13959
QUERY_FILE_INFORMATION 13959
WriteX 13959 2047 1 1
QUERY_FILE_INFORMATION 13959
WriteX 13959 0 2048 2048
Close 13959
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13960
ReadX 13960 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13954
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13960
Close 13950
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13961
ReadX 13961 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13961 4095 1 1
QUERY_FILE_INFORMATION 13961
ReadX 13961 0 4096 4096
WriteX 13961 0 4096 4096
Flush 13961
WriteX 13961 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13962
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13962 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13963
ReadX 13963 0 543 543
ReadX 13962 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13967
FIND_FIRST \clients\client1\~dmtmp\*
Close 13967
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13968
WriteX 13968 2047 1 1
QUERY_FILE_INFORMATION 13968
WriteX 13968 0 2048 2048
Close 13968
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13969
ReadX 13969 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13973
Close 13973
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13974
WriteX 13974 2047 1 1
QUERY_FILE_INFORMATION 13974
WriteX 13974 0 2048 2048
Close 13974
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13975
ReadX 13975 0 2048 2048
ReadX 13962 4096 16384 16384
Close 13975
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13976
ReadX 13976 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13976
Close 13963
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13969 4095 1 1
QUERY_FILE_INFORMATION 13969
ReadX 13969 0 4096 4096
WriteX 13969 0 4096 4096
Close 13969
WriteX 13962 0 8192 8192
Close 13962
WriteX 13951 0 4096 4096
WriteX 13952 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13978
ReadX 13978 0 4096 4096
ReadX 13978 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13978
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13979
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13979 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13980
ReadX 13980 0 543 543
ReadX 13979 0 4096 4096
Close 13979
Close 13961
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13981
QUERY_FILE_INFORMATION 13981
Close 13981
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13980
Close 13951
Close 13952
Close 13953
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13982
FIND_FIRST \clients\client1\~dmtmp\*
Close 13982
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13983
ReadX 13983 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13984
ReadX 13984 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13985
ReadX 13985 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13986
ReadX 13986 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13987
ReadX 13987 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13988
ReadX 13988 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13989
ReadX 13989 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13990
ReadX 13990 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13991
ReadX 13991 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13992
ReadX 13992 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13993
ReadX 13993 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13994
ReadX 13994 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13995
ReadX 13995 0 4096 4096
ReadX 13983 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13999
FIND_FIRST \clients\client1\~dmtmp\*
Close 13999
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 14000
QUERY_FILE_INFORMATION 14000
WriteX 14000 2047 1 1
QUERY_FILE_INFORMATION 14000
WriteX 14000 0 2048 2048
Close 14000
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 14001
ReadX 14001 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 14001
Close 13991
Close 13983
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 14002
ReadX 14002 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14003
FIND_FIRST \clients\client1\~dmtmp\*
Close 14003
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14004
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14004 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14005
ReadX 14005 0 4096 4096
ReadX 14004 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 14009
FIND_FIRST \clients\client1\~dmtmp\*
Close 14009
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 14010
QUERY_FILE_INFORMATION 14010
WriteX 14010 2047 1 1
QUERY_FILE_INFORMATION 14010
WriteX 14010 0 2048 2048
Close 14010
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 14011
ReadX 14011 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 14011
Close 14004
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 14012
ReadX 14012 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 14002 4095 1 1
QUERY_FILE_INFORMATION 14002
ReadX 14002 0 4096 4096
WriteX 14002 0 4096 4096
Flush 14002
WriteX 14012 4095 1 1
QUERY_FILE_INFORMATION 14012
ReadX 14012 0 4096 4096
WriteX 14012 0 4096 4096
Flush 14012
WriteX 14002 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 14012 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14013
ReadX 14013 0 4096 4096
ReadX 14005 0 4096 4096
ReadX 14013 0 4096 4096
ReadX 14013 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 14014
FIND_FIRST \clients\client1\~dmtmp\*
Close 14014
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 14015
WriteX 14015 4095 1 1
QUERY_FILE_INFORMATION 14015
WriteX 14015 0 4096 4096
Close 14015
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 14016
ReadX 14016 0 4096 4096
Close 14013
Close 14005
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 14017
Close 14017
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 14018
WriteX 14018 4095 1 1
QUERY_FILE_INFORMATION 14018
WriteX 14018 0 4096 4096
Close 14018
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 14019
ReadX 14019 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 14019 0 4096 4096
Close 14016
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13995
Close 13989
Close 13992
Close 13993
Close 13994
Close 13990
Close 13984
Close 13987
Close 13988
Close 13985
Close 13986
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 14019
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 14021
Close 14021
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 14022
ReadX 14022 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 14023
Close 14023
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14024
WriteX 14024 2047 1 1
QUERY_FILE_INFORMATION 14024
WriteX 14024 0 2048 2048
Close 14024
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14025
ReadX 14025 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14025
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14026
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14026 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14027
ReadX 14027 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14028
ReadX 14028 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14029
ReadX 14029 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14030
ReadX 14030 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14031
ReadX 14031 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14032
ReadX 14032 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14033
ReadX 14033 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 14034
ReadX 14034 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 14035
ReadX 14035 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 14036
ReadX 14036 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 14037
ReadX 14037 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 14038
ReadX 14038 0 4096 4096
ReadX 14026 0 4096 4096
ReadX 14033 0 4096 4096
Close 14033
Close 14026
Close 14002
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 14039
QUERY_FILE_INFORMATION 14039
Close 14039
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 14022
Close 14037
Close 14032
Close 14034
Close 14035
Close 14036
Close 14038
Close 14027
Close 14030
Close 14031
Close 14028
Close 14029
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 14012
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 14040
QUERY_FILE_INFORMATION 14040
Close 14040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14041
FIND_FIRST \clients\client1\~dmtmp\*
Close 14041
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14042
ReadX 14042 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 14043
ReadX 14043 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 14044
ReadX 14044 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 14045
ReadX 14045 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 14046
ReadX 14046 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14047
ReadX 14047 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14048
ReadX 14048 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14049
ReadX 14049 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14050
ReadX 14050 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14051
ReadX 14051 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14052
ReadX 14052 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 14053
ReadX 14053 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14054
ReadX 14054 0 4096 4096
ReadX 14042 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 14058
FIND_FIRST \clients\client1\~dmtmp\*
Close 14058
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 14059
QUERY_FILE_INFORMATION 14059
WriteX 14059 2047 1 1
QUERY_FILE_INFORMATION 14059
WriteX 14059 0 2048 2048
Close 14059
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 14060
ReadX 14060 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 14060
Close 14042
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 14061
ReadX 14061 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14062
FIND_FIRST \clients\client1\~dmtmp\*
Close 14062
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14063
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14063 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14064
ReadX 14064 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14065
ReadX 14065 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14066
ReadX 14066 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14067
ReadX 14067 0 543 543
ReadX 14063 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 14071
FIND_FIRST \clients\client1\~dmtmp\*
Close 14071
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 14072
QUERY_FILE_INFORMATION 14072
WriteX 14072 2047 1 1
QUERY_FILE_INFORMATION 14072
WriteX 14072 0 2048 2048
Close 14072
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 14073
ReadX 14073 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 14073
Close 14063
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 14074
ReadX 14074 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 14047
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14075
FIND_FIRST \clients\client1\~dmtmp\*
Close 14075
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14076
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14076 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14077
ReadX 14077 0 4096 4096
ReadX 14076 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 14081
FIND_FIRST \clients\client1\~dmtmp\*
Close 14081
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 14082
QUERY_FILE_INFORMATION 14082
WriteX 14082 2047 1 1
QUERY_FILE_INFORMATION 14082
WriteX 14082 0 2048 2048
Close 14082
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 14083
ReadX 14083 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 14083
Close 14077
Close 14076
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 14084
ReadX 14084 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 14061 4095 1 1
QUERY_FILE_INFORMATION 14061
ReadX 14061 0 4096 4096
WriteX 14061 0 4096 4096
Flush 14061
WriteX 14074 4095 1 1
QUERY_FILE_INFORMATION 14074
ReadX 14074 0 4096 4096
WriteX 14074 0 4096 4096
Flush 14074
WriteX 14084 4095 1 1
QUERY_FILE_INFORMATION 14084
ReadX 14084 0 4096 4096
WriteX 14084 0 4096 4096
Flush 14084
WriteX 14061 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 14074 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 14084 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14085
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14085 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14086
ReadX 14086 0 4096 4096
ReadX 14085 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14087
ReadX 14087 0 4096 4096
ReadX 14087 0 4096 4096
ReadX 14087 4096 16384 16384
ReadX 14085 4096 16384 16384
ReadX 14085 0 4096 4096
ReadX 14086 0 4096 4096
ReadX 14086 4096 4096 4096
Close 14087
Close 14086
Close 14085
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14088
FIND_FIRST \clients\client1\~dmtmp\*
Close 14088
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14089
ReadX 14089 0 2048 2048
WriteX 14089 18431 1 1
QUERY_FILE_INFORMATION 14089
WriteX 14089 0 19584 19584
Close 14089
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14090
ReadX 14090 0 4096 4096
ReadX 14090 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14090
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14091
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14091 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14092
ReadX 14092 0 4096 4096
ReadX 14091 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14093
ReadX 14093 0 4096 4096
ReadX 14093 0 4096 4096
Close 14093
Close 14092
Close 14091
Close 14061
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 14094
QUERY_FILE_INFORMATION 14094
Close 14094
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 14067
Close 14054
Close 14046
Close 14064
Close 14065
Close 14066
Close 14053
Close 14048
Close 14051
Close 14052
Close 14049
Close 14050
Close 14043
Close 14044
Close 14045
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 14074
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 14095
QUERY_FILE_INFORMATION 14095
Close 14095
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 14084
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13764
QUERY_FILE_INFORMATION 13764
Close 13764
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13765
FIND_FIRST \clients\client1\~dmtmp\*
Close 13765
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13766
ReadX 13766 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13767
ReadX 13767 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13768
ReadX 13768 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13769
ReadX 13769 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13770
ReadX 13770 0 543 543
ReadX 13766 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13766 4096 16384 16384
WriteX 13766 0 4096 4096
Close 13766
WriteX 13767 0 4096 4096
WriteX 13768 0 4096 4096
WriteX 13769 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13771
FIND_FIRST \clients\client1\~dmtmp\*
Close 13771
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13772
ReadX 13772 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13773
ReadX 13773 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13774
ReadX 13774 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13775
ReadX 13775 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13776
ReadX 13776 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13777
ReadX 13777 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13778
ReadX 13778 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13779
ReadX 13779 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13780
ReadX 13780 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13781
ReadX 13781 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13782
ReadX 13782 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13783
ReadX 13783 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13784
ReadX 13784 0 4096 4096
ReadX 13772 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13785
ReadX 13785 0 8192 8192
ReadX 13772 4096 16384 16384
Close 13779
Close 13772
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13786
FIND_FIRST \clients\client1\~dmtmp\*
Close 13786
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13787
ReadX 13787 0 4096 4096
ReadX 13787 4096 4096 4096
ReadX 13787 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13788
ReadX 13788 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13789
ReadX 13789 0 4096 4096
ReadX 13788 0 4096 4096
ReadX 13788 0 4096 4096
ReadX 13788 4096 16384 16384
Close 13789
WriteX 13788 0 4096 4096
Close 13788
WriteX 13773 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13790
FIND_FIRST \clients\client1\~dmtmp\*
Close 13790
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13791
ReadX 13791 0 4096 4096
ReadX 13791 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13792
ReadX 13792 0 4096 4096
ReadX 13792 0 4096 4096
WriteX 13792 0 4096 4096
Close 13792
WriteX 13767 0 4096 4096
WriteX 13768 0 4096 4096
WriteX 13769 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13793
ReadX 13793 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13794
ReadX 13794 0 4096 4096
ReadX 13793 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13798
FIND_FIRST \clients\client1\~dmtmp\*
Close 13798
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13799
QUERY_FILE_INFORMATION 13799
WriteX 13799 2047 1 1
QUERY_FILE_INFORMATION 13799
WriteX 13799 0 2048 2048
Close 13799
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13800
ReadX 13800 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13800 4095 1 1
QUERY_FILE_INFORMATION 13800
ReadX 13800 0 4096 4096
WriteX 13800 0 4096 4096
Close 13800
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13801
ReadX 13801 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13801 0 4096 4096
Close 13794
Close 13793
WriteX 13801 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13802
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13802 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13803
ReadX 13803 0 4096 4096
ReadX 13802 0 4096 4096
ReadX 13802 4096 16384 16384
Close 13803
Close 13802
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13804
FIND_FIRST \clients\client1\~dmtmp\*
Close 13804
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13805
ReadX 13805 0 4096 4096
ReadX 13805 4096 4096 4096
WriteX 13805 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13805 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13805
ReadX 13801 0 4096 4096
WriteX 13801 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13806
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13806 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13807
ReadX 13807 0 4096 4096
ReadX 13806 0 4096 4096
ReadX 13806 4096 16384 16384
Close 13807
Close 13806
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13808
FIND_FIRST \clients\client1\~dmtmp\*
Close 13808
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13809
ReadX 13809 0 4096 4096
ReadX 13809 4096 4096 4096
WriteX 13809 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13809 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13809
Close 13801
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13810
QUERY_FILE_INFORMATION 13810
Close 13810
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13785
Close 13787
Close 13791
Close 13770
Close 13767
Close 13768
Close 13769
Close 13778
Close 13783
Close 13780
Close 13781
Close 13782
Close 13784
Close 13773
Close 13776
Close 13777
Close 13774
Close 13775
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13811
FIND_FIRST \clients\client1\~dmtmp\*
Close 13811
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13812
ReadX 13812 0 4096 4096
ReadX 13812 4096 4096 4096
ReadX 13812 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13813
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13813 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13814
ReadX 13814 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13815
ReadX 13815 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13816
ReadX 13816 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13817
ReadX 13817 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13818
ReadX 13818 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13819
ReadX 13819 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13820
ReadX 13820 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13821
ReadX 13821 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13822
ReadX 13822 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13823
ReadX 13823 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13824
ReadX 13824 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13825
ReadX 13825 0 4096 4096
ReadX 13813 0 4096 4096
ReadX 13813 0 4096 4096
ReadX 13813 4096 16384 16384
Close 13820
Close 13813
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13826
ReadX 13826 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13827
ReadX 13827 0 4096 4096
ReadX 13826 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13831
FIND_FIRST \clients\client1\~dmtmp\*
Close 13831
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13832
QUERY_FILE_INFORMATION 13832
WriteX 13832 2047 1 1
QUERY_FILE_INFORMATION 13832
WriteX 13832 0 2048 2048
Close 13832
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13833
ReadX 13833 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13833 4095 1 1
QUERY_FILE_INFORMATION 13833
ReadX 13833 0 4096 4096
WriteX 13833 0 4096 4096
Close 13833
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13834
ReadX 13834 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13834 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13838
Close 13838
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13839
QUERY_FILE_INFORMATION 13839
WriteX 13839 2047 1 1
QUERY_FILE_INFORMATION 13839
WriteX 13839 0 2048 2048
Close 13839
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13840
ReadX 13840 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13840 4095 1 1
QUERY_FILE_INFORMATION 13840
ReadX 13840 0 4096 4096
WriteX 13840 0 4096 4096
Close 13840
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13841
ReadX 13841 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13841 0 4096 4096
Close 13826
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13842
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13842 0 4096 4096
ReadX 13842 0 4096 4096
ReadX 13842 4096 16384 16384
Close 13842
Close 13834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13843
QUERY_FILE_INFORMATION 13843
Close 13843
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13812
Close 13824
Close 13819
Close 13825
Close 13827
Close 13814
Close 13817
Close 13818
Close 13815
Close 13816
Close 13821
Close 13822
Close 13823
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13841
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13844
QUERY_FILE_INFORMATION 13844
Close 13844
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13845
ReadX 13845 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13846
Close 13846
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13847
WriteX 13847 63 1 1
QUERY_FILE_INFORMATION 13847
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13845 0 4096 4096
ReadX 13845 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13845 0 8192 8192
Flush 13845
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13845 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13845 0 8192 8192
Flush 13845
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13845 0 8192 8192
Flush 13845
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13845 0 8192 8192
Flush 13845
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13849
Close 13849
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13851
WriteX 13851 4065 1 1
QUERY_FILE_INFORMATION 13851
WriteX 13851 0 62591 62591
Close 13851
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13853
Close 13853
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13855
WriteX 13855 4094 1 1
QUERY_FILE_INFORMATION 13855
WriteX 13855 0 10845 10845
Close 13855
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13857
Close 13857
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13859
WriteX 13859 4081 1 1
QUERY_FILE_INFORMATION 13859
WriteX 13859 0 30118 30118
Close 13859
WriteX 13845 0 4096 4096
Close 13845
WriteX 13847 0 64 64
Close 13847
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13860
ReadX 13860 61440 4096 4096
ReadX 13860 126976 4096 4096
WriteX 13860 0 65471 65471
WriteX 13860 65471 65 65
WriteX 13860 65536 65471 65471
WriteX 13860 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13861
ReadX 13861 61440 4096 4096
ReadX 13861 126976 4096 4096
ReadX 13861 192512 4096 4096
ReadX 13861 258048 4096 4096
WriteX 13861 0 65471 65471
WriteX 13861 65471 65 65
WriteX 13861 65536 65471 65471
WriteX 13861 131007 65 65
WriteX 13861 131072 65471 65471
WriteX 13861 196543 65 65
WriteX 13861 196608 65471 65471
WriteX 13861 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13862
ReadX 13862 61440 4096 4096
ReadX 13862 126976 4096 4096
ReadX 13862 192512 4096 4096
ReadX 13862 258048 4096 4096
ReadX 13862 323584 4096 4096
ReadX 13862 389120 4096 4096
ReadX 13862 454656 4096 4096
ReadX 13862 520192 4096 4096
WriteX 13862 0 65471 65471
WriteX 13862 65471 65 65
WriteX 13862 65536 65471 65471
WriteX 13862 131007 65 65
WriteX 13862 131072 65471 65471
WriteX 13862 196543 65 65
WriteX 13862 196608 65471 65471
WriteX 13862 262079 65 65
WriteX 13862 262144 65471 65471
WriteX 13862 327615 65 65
WriteX 13862 327680 65471 65471
WriteX 13862 393151 65 65
WriteX 13862 393216 65471 65471
WriteX 13862 458687 65 65
WriteX 13862 458752 65471 65471
WriteX 13862 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13863
Close 13863
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13860
Close 13861
Close 13862
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13864
ReadX 13864 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13865
ReadX 13865 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13866
ReadX 13866 0 4096 4096
ReadX 13866 4096 4096 4096
ReadX 13866 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13867
Close 13867
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13864
Close 13865
Close 13866
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13868
Close 13868
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13869
ReadX 13869 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13870
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13871
Close 13871
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13872
ReadX 13872 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13873
Close 13873
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13869
Close 13872
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13874
Close 13874
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13875
ReadX 13875 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13876
ReadX 13876 0 8192 8192
ReadX 13876 8192 8192 8192
ReadX 13876 16384 8192 8192
ReadX 13876 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13878
Close 13878
Close 13875
Close 13876
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13880
WriteX 13880 8191 1 1
QUERY_FILE_INFORMATION 13880
WriteX 13880 0 10438 10438
Close 13880
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13881
Close 13881
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13882
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13883
Close 13883
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13884
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13885
Close 13885
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13886
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13887
FIND_FIRST \clients\client1\~dmtmp\*
Close 13887
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13888
Close 13888
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13889
ReadX 13889 0 4096 4096
Close 13889
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13890
ReadX 13890 0 8192 8192
Close 13890
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13891
ReadX 13891 0 8192 8192
ReadX 13891 8192 4096 4096
ReadX 13891 12288 8192 8192
ReadX 13891 20480 8192 8192
ReadX 13891 28672 8192 8192
ReadX 13891 36864 8192 8192
ReadX 13891 45056 8192 8192
ReadX 13891 53248 8192 8192
ReadX 13891 61440 8192 8192
ReadX 13891 69632 8192 8192
ReadX 13891 77824 8192 8192
ReadX 13891 86016 8192 8192
ReadX 13891 94208 8192 8192
ReadX 13891 102400 8192 8192
ReadX 13891 110592 8192 8192
ReadX 13891 118784 8192 8192
ReadX 13891 126976 8192 8192
ReadX 13891 135168 8192 8192
ReadX 13891 143360 8192 8192
ReadX 13891 151552 8192 8192
ReadX 13891 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13892
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13892
Close 13891
Close 13882
Close 13884
Close 13886
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13893
Close 13893
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13895
WriteX 13895 8191 1 1
QUERY_FILE_INFORMATION 13895
WriteX 13895 0 28489 28489
Close 13895
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13896
Close 13896
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13897
FIND_FIRST \clients\client1\~dmtmp\*
Close 13897
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13898
Close 13898
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13899
ReadX 13899 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13900
Close 13900
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13899
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13901
Close 13901
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13902
ReadX 13902 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13903
ReadX 13903 0 8192 8192
ReadX 13903 8192 8192 8192
ReadX 13903 16384 8192 8192
ReadX 13903 24576 8192 8192
ReadX 13903 32768 16384 16384
ReadX 13903 49152 8192 8192
ReadX 13903 57344 8192 8192
ReadX 13903 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13905
Close 13905
Close 13902
Close 13903
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13907
WriteX 13907 8191 1 1
QUERY_FILE_INFORMATION 13907
WriteX 13907 0 29253 29253
Close 13907
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13908
Close 13908
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13909
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13910
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13910
Close 13909
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13911
Close 13911
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13913
WriteX 13913 8191 1 1
QUERY_FILE_INFORMATION 13913
WriteX 13913 0 30183 30183
Close 13913
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13914
Close 13914
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13915
WriteX 13915 0 510 510
WriteX 13915 510 512 512
WriteX 13915 1022 510 510
WriteX 13915 1532 510 510
WriteX 13915 2042 168 168
Close 13915
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13916
Close 13916
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13917
ReadX 13917 0 4096 4096
WriteX 13917 0 4096 4096
Close 13917
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13918
ReadX 13918 0 65471 65471
ReadX 13918 65471 65 65
ReadX 13918 65536 65471 65471
ReadX 13918 131007 65 65
ReadX 13918 131072 65471 65471
ReadX 13918 196543 65 65
ReadX 13918 196608 65471 65471
ReadX 13918 262079 65 65
ReadX 13918 262144 65471 65471
ReadX 13918 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13919
ReadX 13919 0 65471 65471
ReadX 13919 65471 65 65
ReadX 13919 65536 65471 65471
ReadX 13919 131007 65 65
ReadX 13919 131072 65471 65471
ReadX 13919 196543 65 65
ReadX 13919 196608 65471 65471
ReadX 13919 262079 65 65
ReadX 13919 262144 65471 65471
ReadX 13919 327615 65 65
ReadX 13919 327680 65471 65471
ReadX 13919 393151 65 65
ReadX 13919 393216 65471 65471
ReadX 13919 458687 65 65
ReadX 13919 458752 65471 65471
ReadX 13919 524223 65 65
ReadX 13919 524288 65471 65471
ReadX 13919 589759 65 65
ReadX 13919 589824 65471 65471
ReadX 13919 655295 65 65
ReadX 13919 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13920
ReadX 13920 0 65471 65471
ReadX 13920 65471 65 65
ReadX 13920 65536 65471 65471
ReadX 13920 131007 65 65
ReadX 13920 131072 65471 65471
ReadX 13920 196543 65 65
ReadX 13920 196608 65471 65471
ReadX 13920 262079 65 65
ReadX 13920 262144 65471 65471
ReadX 13920 327615 65 65
ReadX 13920 327680 65471 65471
ReadX 13920 393151 65 65
ReadX 13920 393216 65471 65471
ReadX 13920 458687 65 65
ReadX 13920 458752 65471 65471
ReadX 13920 524223 65 65
ReadX 13920 524288 65471 65471
ReadX 13920 589759 65 65
ReadX 13920 589824 65471 65471
ReadX 13920 655295 65 65
ReadX 13920 655360 65471 65471
ReadX 13920 720831 65 65
ReadX 13920 720896 65471 65471
ReadX 13920 786367 65 65
ReadX 13920 786432 65471 65471
ReadX 13920 851903 65 65
ReadX 13920 851968 65471 65471
ReadX 13920 917439 65 65
ReadX 13920 917504 65471 65471
ReadX 13920 982975 65 65
ReadX 13920 983040 65471 65471
ReadX 13920 1048511 65 65
ReadX 13920 1048576 65471 65471
ReadX 13920 1114047 65 65
ReadX 13920 1114112 65471 65471
ReadX 13920 1179583 65 65
ReadX 13920 1179648 65471 65471
ReadX 13920 1245119 65 65
ReadX 13920 1245184 65471 65471
ReadX 13920 1310655 65 65
ReadX 13920 1310720 65471 65471
ReadX 13920 1376191 65 65
ReadX 13920 1376256 65471 65471
ReadX 13920 1441727 65 65
ReadX 13920 1441792 65471 65471
ReadX 13920 1507263 65 65
ReadX 13920 1507328 65471 65471
ReadX 13920 1572799 65 65
ReadX 13920 1572864 65471 65471
ReadX 13920 1638335 65 65
ReadX 13920 1638400 65471 65471
ReadX 13920 1703871 65 65
ReadX 13920 1703936 65471 65471
ReadX 13920 1769407 65 65
ReadX 13920 1769472 65471 65471
ReadX 13920 1834943 65 65
ReadX 13920 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13921
ReadX 13921 0 4096 4096
ReadX 13921 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13922
WriteX 13922 52 1 1
QUERY_FILE_INFORMATION 13922
WriteX 13922 0 53 53
Close 13922
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13923
Close 13923
Close 13918
Close 13919
Close 13920
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13921 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13924
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13921 0 4096 4096
ReadX 13921 4096 4096 4096
ReadX 13921 8192 4096 4096
ReadX 13921 12288 4096 4096
WriteX 13924 15359 1 1
QUERY_FILE_INFORMATION 13924
ReadX 13921 16384 4096 4096
ReadX 13921 20480 4096 4096
WriteX 13924 0 15360 15360
Close 13924
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13925
ReadX 13925 0 4096 4096
WriteX 13925 0 4096 4096
Close 13925
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13926
Close 13926
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13927
ReadX 13927 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13928
Close 13928
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13921
ReadX 13927 0 4096 4096
ReadX 13927 4096 4096 4096
ReadX 13927 8192 4096 4096
ReadX 13927 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13929
ReadX 13929 0 4096 4096
ReadX 13929 0 4096 4096
ReadX 13929 4096 4096 4096
ReadX 13929 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13930
ReadX 13930 0 4096 4096
ReadX 13930 4096 4096 4096
ReadX 13930 8192 4096 4096
Close 13929
Close 13930
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13931
WriteX 13931 15359 1 1
QUERY_FILE_INFORMATION 13931
WriteX 13931 0 15360 15360
Close 13931
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13932
ReadX 13932 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13927
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13933
Close 13933
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13934
ReadX 13934 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13935
Close 13935
WriteX 13932 0 4096 4096
Close 13932
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13936
Close 13936
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13937
ReadX 13937 0 4096 4096
ReadX 13937 0 4096 4096
ReadX 13937 4096 4096 4096
ReadX 13937 8192 4096 4096
ReadX 13937 12288 3072 3072
ReadX 13937 0 8192 8192
ReadX 13937 8192 4096 4096
ReadX 13937 12288 3072 3072
WriteX 13937 15469 1 1
QUERY_FILE_INFORMATION 13937
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13938
ReadX 13938 0 4096 4096
ReadX 13938 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13939
WriteX 13939 52 1 1
QUERY_FILE_INFORMATION 13939
WriteX 13939 0 53 53
Close 13939
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13940
Close 13940
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13941
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13938 0 8192 8192
ReadX 13938 8192 4096 4096
ReadX 13938 12288 4096 4096
WriteX 13941 12005 1 1
QUERY_FILE_INFORMATION 13941
WriteX 13941 0 12006 12006
Close 13941
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13942
ReadX 13942 0 4096 4096
WriteX 13942 0 4096 4096
Close 13942
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13943
Close 13943
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13944
ReadX 13944 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13945
Close 13945
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13938
ReadX 13944 0 4096 4096
ReadX 13944 4096 4096 4096
ReadX 13944 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13946
WriteX 13946 11990 1 1
QUERY_FILE_INFORMATION 13946
WriteX 13946 0 11991 11991
Close 13946
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13947
ReadX 13947 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13944
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13948
Close 13948
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13949
ReadX 13949 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13950
Close 13950
WriteX 13947 0 4096 4096
Close 13947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13951
Close 13951
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13952
ReadX 13952 0 4096 4096
ReadX 13952 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13953
Close 13953
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
WriteX 13937 0 19054 19054
ReadX 13952 0 8192 8192
ReadX 13952 8192 3799 3799
WriteX 13952 13247 1 1
QUERY_FILE_INFORMATION 13952
WriteX 13952 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13952 0 8192 8192
ReadX 13952 8192 4096 4096
Close 13934
Close 13937
WriteX 13952 0 12288 12288
Close 13952
Close 13949
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13954
Close 13954
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13955
Close 13955
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13956
ReadX 13956 61440 4096 4096
ReadX 13956 126976 4096 4096
WriteX 13956 0 65471 65471
WriteX 13956 65471 65 65
WriteX 13956 65536 65471 65471
WriteX 13956 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13957
ReadX 13957 61440 4096 4096
ReadX 13957 126976 4096 4096
ReadX 13957 192512 4096 4096
ReadX 13957 258048 4096 4096
WriteX 13957 0 65471 65471
WriteX 13957 65471 65 65
WriteX 13957 65536 65471 65471
WriteX 13957 131007 65 65
WriteX 13957 131072 65471 65471
WriteX 13957 196543 65 65
WriteX 13957 196608 65471 65471
WriteX 13957 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13958
ReadX 13958 61440 4096 4096
ReadX 13958 126976 4096 4096
ReadX 13958 192512 4096 4096
ReadX 13958 258048 4096 4096
ReadX 13958 323584 4096 4096
ReadX 13958 389120 4096 4096
ReadX 13958 454656 4096 4096
ReadX 13958 520192 4096 4096
WriteX 13958 0 65471 65471
WriteX 13958 65471 65 65
WriteX 13958 65536 65471 65471
WriteX 13958 131007 65 65
WriteX 13958 131072 65471 65471
WriteX 13958 196543 65 65
WriteX 13958 196608 65471 65471
WriteX 13958 262079 65 65
WriteX 13958 262144 65471 65471
WriteX 13958 327615 65 65
WriteX 13958 327680 65471 65471
WriteX 13958 393151 65 65
WriteX 13958 393216 65471 65471
WriteX 13958 458687 65 65
WriteX 13958 458752 65471 65471
WriteX 13958 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13959
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13959 0 4096 4096
Close 13959
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13960
ReadX 13960 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13960
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13961
ReadX 13961 0 4096 4096
ReadX 13961 4096 4096 4096
ReadX 13961 8192 4096 4096
ReadX 13961 12288 4096 4096
ReadX 13961 16384 4096 4096
ReadX 13961 20480 4096 4096
ReadX 13961 24576 4096 4096
ReadX 13961 28672 4096 4096
ReadX 13961 32768 4096 4096
ReadX 13961 36864 4096 4096
ReadX 13961 40960 4096 4096
ReadX 13961 45056 4096 4096
ReadX 13961 49152 4096 4096
ReadX 13961 53248 4096 4096
ReadX 13961 57344 4096 4096
ReadX 13961 61440 4096 4096
ReadX 13961 65536 4096 4096
ReadX 13961 69632 4096 4096
ReadX 13961 73728 4096 4096
WriteX 13961 0 4096 4096
Close 13961
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13962
Close 13962
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13963
ReadX 13963 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13964
Close 13964
Close 13956
Close 13957
Close 13958
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13963
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13966
WriteX 13966 4607 1 1
QUERY_FILE_INFORMATION 13966
WriteX 13966 0 65471 65471
WriteX 13966 65471 65 65
WriteX 13966 65536 19979 19979
Close 13966
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13967
ReadX 13967 0 4096 4096
WriteX 13967 0 4096 4096
Flush 13967
WriteX 13967 0 4096 4096
Flush 13967
QUERY_FILE_INFORMATION 13967
WriteX 13967 0 4096 4096
Flush 13967
WriteX 13967 0 4096 4096
Flush 13967
WriteX 13967 0 4096 4096
Flush 13967
WriteX 13967 0 4096 4096
Flush 13967
Close 13967
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13968
ReadX 13968 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13969
ReadX 13969 0 4096 4096
Close 13968
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13970
ReadX 13970 0 4096 4096
Close 13970
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13971
ReadX 13971 0 4096 4096
Close 13971
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13972
ReadX 13972 0 4096 4096
WriteX 13972 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13973
Close 13973
Close 13969
Close 13972
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13974
Close 13974
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13976
WriteX 13976 4607 1 1
QUERY_FILE_INFORMATION 13976
WriteX 13976 0 65471 65471
WriteX 13976 65471 65 65
WriteX 13976 65536 17654 17654
Close 13976
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13977
ReadX 13977 0 4096 4096
WriteX 13977 0 4096 4096
Flush 13977
WriteX 13977 0 4096 4096
Flush 13977
QUERY_FILE_INFORMATION 13977
WriteX 13977 0 4096 4096
Flush 13977
WriteX 13977 0 4096 4096
Flush 13977
WriteX 13977 0 4096 4096
Flush 13977
WriteX 13977 0 4096 4096
Flush 13977
Close 13977
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13978
Close 13978
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13979
ReadX 13979 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13980
Close 13980
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13981
ReadX 13981 0 4096 4096
ReadX 13981 4096 4096 4096
ReadX 13981 8192 4096 4096
ReadX 13981 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13981 16384 4096 4096
ReadX 13981 20480 4096 4096
ReadX 13981 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13979
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13982
ReadX 13982 0 4096 4096
Close 13982
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13983
ReadX 13983 0 4096 4096
Close 13983
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13984
ReadX 13984 0 4096 4096
WriteX 13984 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13985
Close 13985
Close 13984
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13986
Close 13986
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13988
WriteX 13988 4607 1 1
QUERY_FILE_INFORMATION 13988
WriteX 13988 0 65471 65471
WriteX 13988 65471 65 65
WriteX 13988 65536 19490 19490
Close 13988
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13989
ReadX 13989 0 4096 4096
WriteX 13989 0 4096 4096
Flush 13989
WriteX 13989 0 4096 4096
Flush 13989
QUERY_FILE_INFORMATION 13989
WriteX 13989 0 4096 4096
Flush 13989
WriteX 13989 0 4096 4096
Flush 13989
WriteX 13989 0 4096 4096
Flush 13989
WriteX 13989 0 4096 4096
Flush 13989
Close 13989
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13990
Close 13990
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13991
ReadX 13991 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13992
Close 13992
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13991
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13993
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13993 0 4096 4096
Close 13993
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13994
ReadX 13994 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13994
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13995
ReadX 13995 0 4096 4096
ReadX 13995 4096 4096 4096
ReadX 13995 8192 4096 4096
ReadX 13995 12288 4096 4096
ReadX 13995 16384 4096 4096
ReadX 13995 20480 4096 4096
ReadX 13995 24576 4096 4096
ReadX 13995 28672 4096 4096
ReadX 13995 32768 4096 4096
ReadX 13995 36864 4096 4096
ReadX 13995 40960 4096 4096
ReadX 13995 45056 4096 4096
ReadX 13995 49152 4096 4096
ReadX 13995 53248 4096 4096
ReadX 13995 57344 4096 4096
ReadX 13995 61440 4096 4096
ReadX 13995 65536 4096 4096
ReadX 13995 69632 4096 4096
ReadX 13995 73728 4096 4096
WriteX 13995 0 4096 4096
Close 13995
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13996
Close 13996
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13997
ReadX 13997 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13998
Close 13998
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13997
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14000
WriteX 14000 4607 1 1
QUERY_FILE_INFORMATION 14000
WriteX 14000 0 65471 65471
WriteX 14000 65471 65 65
WriteX 14000 65536 8866 8866
Close 14000
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14001
ReadX 14001 0 4096 4096
WriteX 14001 0 4096 4096
Flush 14001
WriteX 14001 0 4096 4096
Flush 14001
Close 14001
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14002
ReadX 14002 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14002
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14003
ReadX 14003 0 4096 4096
Close 14003
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14004
ReadX 14004 0 4096 4096
Close 14004
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14005
ReadX 14005 0 4096 4096
WriteX 14005 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 14006
Close 14006
Close 14005
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 14007
Close 14007
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14009
WriteX 14009 4607 1 1
QUERY_FILE_INFORMATION 14009
WriteX 14009 0 65471 65471
WriteX 14009 65471 65 65
WriteX 14009 65536 9298 9298
Close 14009
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14010
ReadX 14010 0 4096 4096
WriteX 14010 0 4096 4096
Flush 14010
WriteX 14010 0 4096 4096
Flush 14010
Close 14010
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14011
Close 14011
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14012
ReadX 14012 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 14013
Close 14013
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 14015
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14015 0 4096 4096
Close 14015
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 14016
ReadX 14016 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14016 4096 4096 4096
ReadX 14016 8192 4096 4096
ReadX 14016 12288 4096 4096
ReadX 14016 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 14012
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14017
ReadX 14017 0 4096 4096
Close 14017
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14018
ReadX 14018 0 4096 4096
Close 14018
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14019
ReadX 14019 0 4096 4096
WriteX 14019 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 14020
Close 14020
Close 14016
Close 14019
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 14021
Close 14021
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14023
WriteX 14023 4607 1 1
QUERY_FILE_INFORMATION 14023
WriteX 14023 0 65471 65471
WriteX 14023 65471 65 65
WriteX 14023 65536 11540 11540
Close 14023
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14024
ReadX 14024 0 4096 4096
WriteX 14024 0 4096 4096
Flush 14024
WriteX 14024 0 4096 4096
Flush 14024
Close 14024
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14025
Close 14025
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14026
ReadX 14026 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 14027
Close 14027
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14026
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14028
ReadX 14028 0 65471 65471
ReadX 14028 65471 65 65
ReadX 14028 65536 65471 65471
ReadX 14028 131007 65 65
ReadX 14028 131072 65471 65471
ReadX 14028 196543 65 65
ReadX 14028 196608 65471 65471
ReadX 14028 262079 65 65
ReadX 14028 262144 65471 65471
ReadX 14028 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14029
ReadX 14029 0 65471 65471
ReadX 14029 65471 65 65
ReadX 14029 65536 65471 65471
ReadX 14029 131007 65 65
ReadX 14029 131072 65471 65471
ReadX 14029 196543 65 65
ReadX 14029 196608 65471 65471
ReadX 14029 262079 65 65
ReadX 14029 262144 65471 65471
ReadX 14029 327615 65 65
ReadX 14029 327680 65471 65471
ReadX 14029 393151 65 65
ReadX 14029 393216 65471 65471
ReadX 14029 458687 65 65
ReadX 14029 458752 65471 65471
ReadX 14029 524223 65 65
ReadX 14029 524288 65471 65471
ReadX 14029 589759 65 65
ReadX 14029 589824 65471 65471
ReadX 14029 655295 65 65
ReadX 14029 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14030
ReadX 14030 0 65471 65471
ReadX 14030 65471 65 65
ReadX 14030 65536 65471 65471
ReadX 14030 131007 65 65
ReadX 14030 131072 65471 65471
ReadX 14030 196543 65 65
ReadX 14030 196608 65471 65471
ReadX 14030 262079 65 65
ReadX 14030 262144 65471 65471
Close 13981
ReadX 14030 327615 65 65
ReadX 14030 327680 65471 65471
Close 14028
ReadX 14030 393151 65 65
Close 14029
ReadX 14030 393216 65471 65471
ReadX 14030 458687 65 65
ReadX 14030 458752 65471 65471
ReadX 14030 524223 65 65
ReadX 14030 524288 65471 65471
ReadX 14030 589759 65 65
ReadX 14030 589824 65471 65471
ReadX 14030 655295 65 65
ReadX 14030 655360 65471 65471
ReadX 14030 720831 65 65
ReadX 14030 720896 65471 65471
ReadX 14030 786367 65 65
ReadX 14030 786432 65471 65471
ReadX 14030 851903 65 65
ReadX 14030 851968 65471 65471
ReadX 14030 917439 65 65
ReadX 14030 917504 65471 65471
ReadX 14030 982975 65 65
ReadX 14030 983040 65471 65471
ReadX 14030 1048511 65 65
ReadX 14030 1048576 65471 65471
ReadX 14030 1114047 65 65
ReadX 14030 1114112 65471 65471
ReadX 14030 1179583 65 65
ReadX 14030 1179648 65471 65471
ReadX 14030 1245119 65 65
ReadX 14030 1245184 65471 65471
ReadX 14030 1310655 65 65
ReadX 14030 1310720 65471 65471
ReadX 14030 1376191 65 65
ReadX 14030 1376256 65471 65471
ReadX 14030 1441727 65 65
ReadX 14030 1441792 65471 65471
ReadX 14030 1507263 65 65
ReadX 14030 1507328 65471 65471
ReadX 14030 1572799 65 65
ReadX 14030 1572864 65471 65471
ReadX 14030 1638335 65 65
ReadX 14030 1638400 65471 65471
ReadX 14030 1703871 65 65
ReadX 14030 1703936 65471 65471
ReadX 14030 1769407 65 65
ReadX 14030 1769472 65471 65471
ReadX 14030 1834943 65 65
ReadX 14030 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 14031
FIND_FIRST \clients\client1\~dmtmp\*
Close 14031
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 14032
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 14033
QUERY_FILE_INFORMATION 14033
QUERY_FILE_INFORMATION 14033
QUERY_FILE_INFORMATION 14033
ReadX 14033 2156 24 24
ReadX 14033 2139 276 276
ReadX 14033 2136 14 14
ReadX 14033 2136 7 7
ReadX 14033 2138 12 12
ReadX 14033 2137 8 8
ReadX 14033 2135 15 15
ReadX 14033 0 16 16
ReadX 14033 16 2048 2048
ReadX 14033 2064 2048 2048
ReadX 14033 257 2048 2048
ReadX 14033 385 2048 2048
ReadX 14033 513 2048 2048
ReadX 14033 641 2048 2048
ReadX 14033 769 2048 2048
ReadX 14033 897 2048 2048
ReadX 14033 1025 2048 2048
ReadX 14033 1153 2048 2048
ReadX 14033 1281 2048 2048
ReadX 14033 1409 2048 2048
ReadX 14033 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 14035
Close 14035
Close 14030
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14037
WriteX 14037 15 1 1
QUERY_FILE_INFORMATION 14037
WriteX 14037 0 10575 10575
Flush 14037
Close 14037
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14038
Close 14038
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 14039
ReadX 14039 0 4096 4096
Close 14033
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14040
Close 14040
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14041
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14042
QUERY_FILE_INFORMATION 14042
ReadX 14042 0 512 512
ReadX 14042 512 512 512
ReadX 14042 1024 512 512
QUERY_FILE_INFORMATION 14042
QUERY_FILE_INFORMATION 14042
Close 14042
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14043
QUERY_FILE_INFORMATION 14043
ReadX 14043 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 14044
QUERY_FILE_INFORMATION 14044
ReadX 14044 0 512 512
ReadX 14044 512 512 512
ReadX 14044 1024 512 512
ReadX 14044 288 20 20
ReadX 14044 308 2084 2084
ReadX 14044 388 2084 2084
ReadX 14044 388 2084 2084
ReadX 14032 2157 1386 1386
ReadX 14044 2472 399 399
ReadX 14044 3072 1536 1536
ReadX 14044 544 149 149
ReadX 14044 693 485 485
Close 14044
ReadX 14032 2157 4096 4096
ReadX 14032 6253 4096 4096
ReadX 14032 10349 4096 4096
ReadX 14032 14445 4096 4096
ReadX 14032 18541 4096 4096
ReadX 14032 22637 256 256
ReadX 14032 22893 4096 4096
ReadX 14032 26989 4096 4096
ReadX 14032 31085 4096 4096
ReadX 14032 35181 4096 4096
ReadX 14032 39277 4096 4096
ReadX 14032 43373 4096 4096
ReadX 14032 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 14032 2157 1024 1024
ReadX 14032 1667 4688 4688
ReadX 14032 6355 3516 3516
ReadX 14032 9871 16384 16384
ReadX 14032 26255 3771 3771
ReadX 14032 30026 2048 2048
ReadX 14032 32074 1024 1024
ReadX 14032 33098 6652 6652
ReadX 14032 39750 16384 16384
ReadX 14032 56134 10496 10496
ReadX 14032 66630 1784 1784
ReadX 14032 68414 90 90
ReadX 14032 68504 273 273
ReadX 14032 68777 1600 1600
ReadX 14032 70377 640 640
ReadX 14032 71017 1280 1280
ReadX 14032 72297 8464 8464
ReadX 14032 80761 158 158
ReadX 14032 80919 912 912
ReadX 14032 81831 1980 1980
ReadX 14032 83811 2256 2256
ReadX 14032 86067 400 400
ReadX 14032 86467 252 252
ReadX 14032 86719 42 42
ReadX 14032 86761 725 725
ReadX 14032 2009 512 512
ReadX 14032 3895 9 9
ReadX 14032 3781 46 46
ReadX 14032 4059 92 92
ReadX 14032 3781 92 92
ReadX 14032 3986 184 184
ReadX 14032 3987 16384 16384
ReadX 14032 3902 16384 16384
ReadX 14032 3781 10240 10240
ReadX 14032 3821 16384 16384
ReadX 14032 3891 935 935
ReadX 14032 4060 10240 10240
ReadX 14032 4059 184 184
ReadX 14032 256 184 184
ReadX 14032 256 1026 1026
ReadX 14032 3901 326 326
ReadX 14032 3899 652 652
ReadX 14032 256 2 2
ReadX 14032 258 4948 4948
Close 14032
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 14046
Close 14046
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 14048
WriteX 14048 4055 1 1
QUERY_FILE_INFORMATION 14048
WriteX 14048 0 65471 65471
WriteX 14048 65471 65 65
WriteX 14048 65536 65471 65471
WriteX 14048 131007 65 65
WriteX 14048 131072 65471 65471
WriteX 14048 196543 65 65
WriteX 14048 196608 65471 65471
WriteX 14048 262079 65 65
WriteX 14048 262144 65471 65471
WriteX 14048 327615 65 65
WriteX 14048 327680 65471 65471
WriteX 14048 393151 65 65
WriteX 14048 393216 65471 65471
WriteX 14048 458687 65 65
WriteX 14048 458752 65471 65471
WriteX 14048 524223 65 65
WriteX 14048 524288 65471 65471
WriteX 14048 589759 65 65
WriteX 14048 589824 35257 35257
Close 14048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 14050
Close 14050
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 14052
WriteX 14052 4055 1 1
QUERY_FILE_INFORMATION 14052
WriteX 14052 0 65471 65471
WriteX 14052 65471 65 65
WriteX 14052 65536 65471 65471
WriteX 14052 131007 65 65
WriteX 14052 131072 65471 65471
WriteX 14052 196543 65 65
WriteX 14052 196608 65471 65471
WriteX 14052 262079 65 65
WriteX 14052 262144 65471 65471
WriteX 14052 327615 65 65
WriteX 14052 327680 65471 65471
WriteX 14052 393151 65 65
WriteX 14052 393216 65471 65471
WriteX 14052 458687 65 65
WriteX 14052 458752 65471 65471
WriteX 14052 524223 65 65
WriteX 14052 524288 65471 65471
WriteX 14052 589759 65 65
WriteX 14052 589824 57598 57598
Close 14052
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14054
WriteX 14054 15 1 1
QUERY_FILE_INFORMATION 14054
WriteX 14054 0 12543 12543
Flush 14054
Close 14054
Close 14039
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14055
Close 14055
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 14056
ReadX 14056 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 14057
FIND_FIRST \clients\client1\~dmtmp\*
Close 14057
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 14058
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 14059
QUERY_FILE_INFORMATION 14059
QUERY_FILE_INFORMATION 14059
QUERY_FILE_INFORMATION 14059
ReadX 14059 1938 24 24
ReadX 14059 1920 276 276
ReadX 14059 1918 14 14
ReadX 14059 1918 7 7
ReadX 14059 1919 12 12
ReadX 14059 1919 8 8
ReadX 14059 1917 15 15
ReadX 14059 0 16 16
ReadX 14059 16 2048 2048
ReadX 14059 2064 2048 2048
ReadX 14059 257 2048 2048
ReadX 14059 385 2048 2048
ReadX 14059 513 2048 2048
ReadX 14059 641 2048 2048
ReadX 14059 769 2048 2048
ReadX 14059 897 2048 2048
ReadX 14059 1025 2048 2048
ReadX 14059 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 14061
Close 14061
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14063
WriteX 14063 15 1 1
QUERY_FILE_INFORMATION 14063
WriteX 14063 0 11588 11588
Flush 14063
Close 14063
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14064
Close 14064
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 14065
ReadX 14065 0 4096 4096
Close 14059
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14067
WriteX 14067 15 1 1
QUERY_FILE_INFORMATION 14067
WriteX 14067 0 11615 11615
Flush 14067
Close 14067
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 14065
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14068
Close 14068
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 14069
ReadX 14069 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 14071
Close 14071
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 14073
WriteX 14073 4088 1 1
QUERY_FILE_INFORMATION 14073
WriteX 14073 0 65471 65471
WriteX 14073 65471 65 65
WriteX 14073 65536 16050 16050
Close 14073
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14058 1939 64 64
ReadX 14058 128 248 248
ReadX 14058 128 568 568
ReadX 14058 3872 1536 1536
ReadX 14058 3456 2560 2560
ReadX 14058 3136 512 512
ReadX 14058 2880 4096 4096
ReadX 14058 3264 3072 3072
ReadX 14058 320 4096 4096
ReadX 14058 1024 4096 4096
ReadX 14058 3616 4096 4096
ReadX 14058 1939 64 64
ReadX 14058 128 248 248
ReadX 14058 128 608 608
ReadX 14058 2858 1024 1024
ReadX 14058 2810 4096 4096
ReadX 14058 2826 4096 4096
ReadX 14058 2580 2048 2048
ReadX 14058 2800 2560 2560
ReadX 14058 2100 4096 4096
ReadX 14058 2084 4096 4096
ReadX 14058 868 4096 4096
ReadX 14058 2324 4096 4096
ReadX 14058 884 4096 4096
ReadX 14058 2604 1024 1024
ReadX 14058 580 4096 4096
ReadX 14058 596 4096 4096
ReadX 14058 2752 4096 4096
ReadX 14058 2842 1024 1024
ReadX 14058 660 4096 4096
ReadX 14058 2720 4096 4096
ReadX 14058 2736 4096 4096
ReadX 14058 628 4096 4096
ReadX 14058 2704 4096 4096
ReadX 14058 1556 4096 4096
ReadX 14058 576 4096 4096
ReadX 14058 3168 1536 1536
ReadX 14058 832 4096 4096
ReadX 14058 1088 4096 4096
ReadX 14058 1344 4096 4096
ReadX 14058 1600 4096 4096
ReadX 14058 1856 4096 4096
ReadX 14058 2112 4096 4096
ReadX 14058 1892 4096 4096
ReadX 14058 820 4096 4096
ReadX 14058 788 4096 4096
ReadX 14058 1604 4096 4096
ReadX 14058 3648 4096 4096
ReadX 14058 2608 4096 4096
ReadX 14058 548 4096 4096
ReadX 14058 740 4096 4096
ReadX 14058 1344 4096 4096
ReadX 14058 3392 4096 4096
ReadX 14058 3904 4096 4096
ReadX 14058 644 4096 4096
ReadX 14058 676 4096 4096
ReadX 14058 2688 4096 4096
ReadX 14058 320 4096 4096
ReadX 14058 900 4096 4096
ReadX 14058 1908 4096 4096
ReadX 14058 852 4096 4096
ReadX 14058 724 4096 4096
ReadX 14058 2292 4096 4096
ReadX 14058 612 4096 4096
ReadX 14058 388 4096 4096
ReadX 14058 2368 4096 4096
ReadX 14058 2624 4096 4096
ReadX 14058 500 4096 4096
ReadX 14058 356 4096 4096
ReadX 14058 1024 4096 4096
ReadX 14058 576 4096 4096
ReadX 14058 340 4096 4096
ReadX 14058 420 4096 4096
ReadX 14058 1600 4096 4096
ReadX 14058 404 4096 4096
ReadX 14058 1428 4096 4096
ReadX 14058 2656 4096 4096
ReadX 14058 2624 4096 4096
ReadX 14058 452 4096 4096
ReadX 14058 692 4096 4096
ReadX 14058 564 4096 4096
ReadX 14058 372 4096 4096
ReadX 14058 468 4096 4096
ReadX 14058 484 4096 4096
ReadX 14058 1088 4096 4096
ReadX 14058 1924 4096 4096
ReadX 14058 2768 4096 4096
ReadX 14058 832 4096 4096
ReadX 14058 836 4096 4096
ReadX 14058 1856 4096 4096
ReadX 14058 2640 4096 4096
ReadX 14058 436 4096 4096
ReadX 14058 1828 4096 4096
ReadX 14058 804 4096 4096
ReadX 14058 1860 4096 4096
ReadX 14058 1812 4096 4096
ReadX 14058 756 4096 4096
ReadX 14058 1636 4096 4096
ReadX 14058 772 4096 4096
ReadX 14058 2036 4096 4096
ReadX 14058 1220 4096 4096
ReadX 14058 1652 4096 4096
ReadX 14058 2588 4096 4096
ReadX 14058 916 4096 4096
ReadX 14058 260 4096 4096
ReadX 14058 932 4096 4096
ReadX 14058 2624 4096 4096
ReadX 14058 308 4096 4096
ReadX 14058 292 4096 4096
ReadX 14058 1140 4096 4096
ReadX 14058 276 4096 4096
ReadX 14058 2020 4096 4096
ReadX 14058 2880 4096 4096
ReadX 14058 516 4096 4096
ReadX 14058 1844 4096 4096
ReadX 14058 1124 4096 4096
ReadX 14058 3136 4096 4096
ReadX 14058 324 4096 4096
ReadX 14058 1156 4096 4096
ReadX 14058 1172 4096 4096
ReadX 14058 2112 4096 4096
ReadX 14058 2368 4096 4096
ReadX 14058 964 4096 4096
ReadX 14058 980 4096 4096
ReadX 14058 1012 4096 4096
ReadX 14058 532 4096 4096
ReadX 14058 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 14058 1620 4096 4096
ReadX 14058 1604 4096 4096
ReadX 14058 2116 4096 4096
ReadX 14058 2132 4096 4096
ReadX 14058 2148 4096 4096
ReadX 14058 2276 4096 4096
ReadX 14058 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 14075
Close 14075
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 14077
QUERY_FILE_INFORMATION 14041
Close 14041
WriteX 14077 4088 1 1
QUERY_FILE_INFORMATION 14077
QUERY_FILE_INFORMATION 14043
Close 14043
WriteX 14077 0 65471 65471
WriteX 14077 65471 65 65
WriteX 14077 65536 64850 64850
Close 14077
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14079
WriteX 14079 15 1 1
QUERY_FILE_INFORMATION 14079
ReadX 14058 2068 4096 4096
ReadX 14058 1588 4096 4096
ReadX 14058 1572 4096 4096
WriteX 14079 0 18630 18630
Flush 14079
Close 14079
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 14069
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14080
Close 14080
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 14081
ReadX 14081 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 14058 612 4096 4096
ReadX 14058 564 4096 4096
ReadX 14058 1876 4096 4096
ReadX 14058 628 4096 4096
ReadX 14058 740 4096 4096
ReadX 14058 724 4096 4096
ReadX 14058 644 4096 4096
ReadX 14058 2324 4096 4096
ReadX 14058 660 4096 4096
ReadX 14058 852 4096 4096
ReadX 14058 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 14058 2368 4096 4096
ReadX 14058 1024 4096 4096
ReadX 14058 320 4096 4096
ReadX 14058 580 4096 4096
ReadX 14058 3136 512 512
ReadX 14058 2880 4096 4096
Close 14058
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14082
ReadX 14082 61440 4096 4096
ReadX 14082 126976 4096 4096
WriteX 14082 0 65471 65471
WriteX 14082 65471 65 65
WriteX 14082 65536 65471 65471
WriteX 14082 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14083
ReadX 14083 61440 4096 4096
ReadX 14083 126976 4096 4096
ReadX 14083 192512 4096 4096
ReadX 14083 258048 4096 4096
WriteX 14083 0 65471 65471
WriteX 14083 65471 65 65
WriteX 14083 65536 65471 65471
WriteX 14083 131007 65 65
WriteX 14083 131072 65471 65471
WriteX 14083 196543 65 65
WriteX 14083 196608 65471 65471
WriteX 14083 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14084
ReadX 14084 61440 4096 4096
ReadX 14084 126976 4096 4096
ReadX 14084 192512 4096 4096
ReadX 14084 258048 4096 4096
ReadX 14084 323584 4096 4096
ReadX 14084 389120 4096 4096
ReadX 14084 454656 4096 4096
ReadX 14084 520192 4096 4096
WriteX 14084 0 65471 65471
WriteX 14084 65471 65 65
WriteX 14084 65536 65471 65471
WriteX 14084 131007 65 65
WriteX 14084 131072 65471 65471
WriteX 14084 196543 65 65
WriteX 14084 196608 65471 65471
WriteX 14084 262079 65 65
WriteX 14084 262144 65471 65471
WriteX 14084 327615 65 65
WriteX 14084 327680 65471 65471
WriteX 14084 393151 65 65
WriteX 14084 393216 65471 65471
WriteX 14084 458687 65 65
WriteX 14084 458752 65471 65471
WriteX 14084 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14085
Close 14085
Close 14081
Close 14056
Close 14082
Close 14083
Close 14084
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14086
Close 14086
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14089
Close 14089
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 14091
Close 14091
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 14092
Close 14092
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14095
Close 14095
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13604
Close 13604
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13605
Close 13605
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13608
Close 13608
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13612
Close 13612
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13616
Close 13616
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13620
Close 13620
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13624
Close 13624
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13628
Close 13628
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13632
Close 13632
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13636
Close 13636
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13638
Close 13638
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13640
Close 13640
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13642
WriteX 13642 4095 1 1
QUERY_FILE_INFORMATION 13642
QUERY_FS_INFORMATION 259
WriteX 13642 0 65471 65471
WriteX 13642 65471 65 65
WriteX 13642 65536 65471 65471
WriteX 13642 131007 65 65
WriteX 13642 131072 65471 65471
WriteX 13642 196543 65 65
WriteX 13642 196608 65471 65471
WriteX 13642 262079 65 65
WriteX 13642 262144 26634 26634
Close 13642
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13647
Close 13647
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13648
Close 13648
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13649
ReadX 13649 0 4096 4096
Close 13649
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13650
ReadX 13650 0 4096 4096
ReadX 13650 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13651
Close 13651
Close 13650
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13654
Close 13654
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13656
Close 13656
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13657
Close 13657
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13660
Close 13660
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13662
Close 13662
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13663
Close 13663
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13666
Close 13666
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13670
Close 13670
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13674
Close 13674
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13678
Close 13678
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13682
Close 13682
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13686
Close 13686
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13689
Close 13689
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13693
Close 13693
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13697
Close 13697
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13699
Close 13699
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13700
Close 13700
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13709
Close 13709
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13710
FIND_FIRST \clients\client1\~dmtmp\*
Close 13710
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13711
Close 13711
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13712
ReadX 13712 0 4096 4096
Close 13712
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13713
ReadX 13713 0 4096 4096
Close 13713
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13714
ReadX 13714 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13724
Close 13724
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13725
FIND_FIRST \clients\client1\~dmtmp\*
Close 13725
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13726
Close 13726
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13727
ReadX 13727 0 4096 4096
Close 13727
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13728
ReadX 13728 0 4096 4096
Close 13728
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13729
ReadX 13729 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13730
ReadX 13730 0 65471 65471
ReadX 13730 65471 65 65
ReadX 13730 65536 65471 65471
ReadX 13730 131007 65 65
ReadX 13730 131072 65471 65471
ReadX 13730 196543 65 65
ReadX 13730 196608 65471 65471
ReadX 13730 262079 65 65
ReadX 13730 262144 65471 65471
ReadX 13730 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13731
ReadX 13731 0 65471 65471
ReadX 13731 65471 65 65
ReadX 13731 65536 65471 65471
ReadX 13731 131007 65 65
ReadX 13731 131072 65471 65471
ReadX 13731 196543 65 65
ReadX 13731 196608 65471 65471
ReadX 13731 262079 65 65
ReadX 13731 262144 65471 65471
ReadX 13731 327615 65 65
ReadX 13731 327680 65471 65471
ReadX 13731 393151 65 65
ReadX 13731 393216 65471 65471
ReadX 13731 458687 65 65
ReadX 13731 458752 65471 65471
ReadX 13731 524223 65 65
ReadX 13731 524288 65471 65471
ReadX 13731 589759 65 65
ReadX 13731 589824 65471 65471
ReadX 13731 655295 65 65
ReadX 13731 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13732
ReadX 13732 0 65471 65471
ReadX 13732 65471 65 65
ReadX 13732 65536 65471 65471
ReadX 13732 131007 65 65
ReadX 13732 131072 65471 65471
ReadX 13732 196543 65 65
ReadX 13732 196608 65471 65471
ReadX 13732 262079 65 65
ReadX 13732 262144 65471 65471
ReadX 13732 327615 65 65
ReadX 13732 327680 65471 65471
ReadX 13732 393151 65 65
ReadX 13732 393216 65471 65471
ReadX 13732 458687 65 65
ReadX 13732 458752 65471 65471
ReadX 13732 524223 65 65
ReadX 13732 524288 65471 65471
ReadX 13732 589759 65 65
ReadX 13732 589824 65471 65471
ReadX 13732 655295 65 65
ReadX 13732 655360 65471 65471
Close 13714
ReadX 13732 720831 65 65
Close 13729
ReadX 13732 720896 65471 65471
Close 13730
ReadX 13732 786367 65 65
ReadX 13732 786432 65471 65471
Close 13731
ReadX 13732 851903 65 65
ReadX 13732 851968 65471 65471
ReadX 13732 917439 65 65
ReadX 13732 917504 65471 65471
ReadX 13732 982975 65 65
ReadX 13732 983040 65471 65471
ReadX 13732 1048511 65 65
ReadX 13732 1048576 65471 65471
ReadX 13732 1114047 65 65
ReadX 13732 1114112 65471 65471
ReadX 13732 1179583 65 65
ReadX 13732 1179648 65471 65471
ReadX 13732 1245119 65 65
ReadX 13732 1245184 65471 65471
ReadX 13732 1310655 65 65
ReadX 13732 1310720 65471 65471
ReadX 13732 1376191 65 65
ReadX 13732 1376256 65471 65471
ReadX 13732 1441727 65 65
ReadX 13732 1441792 65471 65471
ReadX 13732 1507263 65 65
ReadX 13732 1507328 65471 65471
ReadX 13732 1572799 65 65
ReadX 13732 1572864 65471 65471
ReadX 13732 1638335 65 65
ReadX 13732 1638400 65471 65471
ReadX 13732 1703871 65 65
ReadX 13732 1703936 65471 65471
ReadX 13732 1769407 65 65
ReadX 13732 1769472 65471 65471
ReadX 13732 1834943 65 65
ReadX 13732 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13733
ReadX 13733 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13733 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13733 8192 4096 4096
ReadX 13733 12288 4096 4096
ReadX 13733 16384 4096 4096
ReadX 13733 20480 4096 4096
ReadX 13733 24576 4096 4096
ReadX 13733 28672 4096 4096
ReadX 13733 32768 4096 4096
ReadX 13733 36864 4096 4096
ReadX 13733 40960 4096 4096
ReadX 13733 45056 4096 4096
ReadX 13733 49152 4096 4096
ReadX 13733 53248 4096 4096
ReadX 13733 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13733 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13734
Close 13734
Close 13732
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13735
WriteX 13735 1535 1 1
QUERY_FILE_INFORMATION 13735
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13733 0 4096 4096
ReadX 13733 4096 4096 4096
QUERY_FILE_INFORMATION 13735
WriteX 13735 0 57088 57088
WriteX 13735 0 4096 4096
Flush 13735
Close 13733
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13736
Close 13736
WriteX 13735 0 4096 4096
Close 13735
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13737
Close 13737
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13738
ReadX 13738 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13738 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13739
WriteX 13739 1535 1 1
QUERY_FILE_INFORMATION 13739
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13738 0 4096 4096
QUERY_FILE_INFORMATION 13739
WriteX 13739 0 51456 51456
WriteX 13739 0 4096 4096
Flush 13739
Close 13738
WriteX 13739 0 4096 4096
Close 13739
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13740
Close 13740
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13741
ReadX 13741 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13741 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13743
Close 13743
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13745
WriteX 13745 4045 1 1
QUERY_FILE_INFORMATION 13745
WriteX 13745 0 53077 53077
Close 13745
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13746
WriteX 13746 1535 1 1
QUERY_FILE_INFORMATION 13746
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13741 0 4096 4096
QUERY_FILE_INFORMATION 13746
WriteX 13746 0 65471 65471
WriteX 13746 65471 65 65
WriteX 13746 65536 1856 1856
WriteX 13746 0 4096 4096
Flush 13746
Close 13741
WriteX 13746 0 4096 4096
Close 13746
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13747
Close 13747
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13748
ReadX 13748 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13750
Close 13750
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13752
WriteX 13752 4076 1 1
QUERY_FILE_INFORMATION 13752
WriteX 13752 0 7983 7983
Close 13752
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13754
Close 13754
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13756
WriteX 13756 4095 1 1
QUERY_FILE_INFORMATION 13756
WriteX 13756 0 65471 65471
WriteX 13756 65471 65 65
WriteX 13756 65536 65471 65471
WriteX 13756 131007 65 65
WriteX 13756 131072 65471 65471
WriteX 13756 196543 65 65
WriteX 13756 196608 65471 65471
WriteX 13756 262079 65 65
WriteX 13756 262144 65471 65471
WriteX 13756 327615 65 65
WriteX 13756 327680 65471 65471
WriteX 13756 393151 65 65
WriteX 13756 393216 65471 65471
WriteX 13756 458687 65 65
WriteX 13756 458752 46731 46731
Close 13756
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13757
WriteX 13757 1535 1 1
QUERY_FILE_INFORMATION 13757
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13748 0 4096 4096
ReadX 13748 4096 4096 4096
QUERY_FILE_INFORMATION 13757
WriteX 13757 0 65471 65471
WriteX 13757 65471 65 65
WriteX 13757 65536 22848 22848
WriteX 13757 0 4096 4096
Flush 13757
Close 13748
WriteX 13757 0 4096 4096
Close 13757
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13758
Close 13758
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13759
ReadX 13759 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13759 4096 4096 4096
Close 13759
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13760
ReadX 13760 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13760 0 8192 8192
ReadX 13760 8192 4096 4096
ReadX 13760 12288 4096 4096
ReadX 13760 16384 4096 4096
ReadX 13760 20480 4096 4096
ReadX 13760 24576 4096 4096
ReadX 13760 28672 4096 4096
ReadX 13760 32768 4096 4096
ReadX 13760 36864 4096 4096
ReadX 13760 40960 4096 4096
ReadX 13760 45056 4096 4096
ReadX 13760 49152 4096 4096
ReadX 13760 53248 4096 4096
ReadX 13760 57344 4096 4096
ReadX 13760 61440 4096 4096
ReadX 13760 65536 4096 4096
ReadX 13760 69632 4096 4096
ReadX 13760 73728 4096 4096
ReadX 13760 77824 4096 4096
ReadX 13760 81920 4096 4096
ReadX 13760 86016 4096 4096
ReadX 13760 90112 4096 4096
ReadX 13760 94208 4096 4096
ReadX 13760 98304 4096 4096
ReadX 13760 102400 4096 4096
ReadX 13760 106496 4096 4096
ReadX 13760 110592 4096 4096
ReadX 13760 114688 4096 4096
ReadX 13760 118784 4096 4096
ReadX 13760 122880 4096 4096
ReadX 13760 126976 4096 4096
ReadX 13760 131072 4096 4096
ReadX 13760 135168 4096 4096
ReadX 13760 139264 4096 4096
ReadX 13760 143360 4096 4096
ReadX 13760 147456 4096 4096
ReadX 13760 151552 4096 4096
ReadX 13760 155648 4096 4096
ReadX 13760 159744 4096 4096
ReadX 13760 163840 4096 4096
ReadX 13760 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13760 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13761
Close 13761
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13762
WriteX 13762 2047 1 1
QUERY_FILE_INFORMATION 13762
Close 13760
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13763
Close 13763
WriteX 13762 0 42388 42388
Close 13762
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13764
Close 13764
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13765
ReadX 13765 0 4096 4096
ReadX 13765 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13766
WriteX 13766 2047 1 1
QUERY_FILE_INFORMATION 13766
Close 13765
WriteX 13766 0 42652 42652
Close 13766
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13767
Close 13767
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13768
ReadX 13768 0 4096 4096
ReadX 13768 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13770
Close 13770
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13772
WriteX 13772 4080 1 1
QUERY_FILE_INFORMATION 13772
WriteX 13772 0 65471 65471
WriteX 13772 65471 65 65
WriteX 13772 65536 49 49
Close 13772
Close 13768
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13773
ReadX 13773 61440 4096 4096
ReadX 13773 126976 4096 4096
WriteX 13773 0 65471 65471
WriteX 13773 65471 65 65
WriteX 13773 65536 65471 65471
WriteX 13773 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13774
ReadX 13774 61440 4096 4096
ReadX 13774 126976 4096 4096
ReadX 13774 192512 4096 4096
ReadX 13774 258048 4096 4096
WriteX 13774 0 65471 65471
WriteX 13774 65471 65 65
WriteX 13774 65536 65471 65471
WriteX 13774 131007 65 65
WriteX 13774 131072 65471 65471
WriteX 13774 196543 65 65
WriteX 13774 196608 65471 65471
WriteX 13774 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13775
ReadX 13775 61440 4096 4096
ReadX 13775 126976 4096 4096
ReadX 13775 192512 4096 4096
ReadX 13775 258048 4096 4096
ReadX 13775 323584 4096 4096
ReadX 13775 389120 4096 4096
ReadX 13775 454656 4096 4096
ReadX 13775 520192 4096 4096
WriteX 13775 0 65471 65471
WriteX 13775 65471 65 65
WriteX 13775 65536 65471 65471
WriteX 13775 131007 65 65
WriteX 13775 131072 65471 65471
WriteX 13775 196543 65 65
WriteX 13775 196608 65471 65471
WriteX 13775 262079 65 65
WriteX 13775 262144 65471 65471
WriteX 13775 327615 65 65
WriteX 13775 327680 65471 65471
WriteX 13775 393151 65 65
WriteX 13775 393216 65471 65471
WriteX 13775 458687 65 65
WriteX 13775 458752 65471 65471
WriteX 13775 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13776
FIND_FIRST \clients\client1\~dmtmp\*
Close 13776
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13777
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13777 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13778
ReadX 13778 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13779
ReadX 13779 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13780
ReadX 13780 0 4096 4096
ReadX 13777 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13777
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13781
ReadX 13781 0 4096 4096
ReadX 13781 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13782
FIND_FIRST \clients\client1\~dmtmp\*
Close 13782
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13783
QUERY_FILE_INFORMATION 13783
WriteX 13783 2047 1 1
QUERY_FILE_INFORMATION 13783
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13784
Close 13784
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13785
WriteX 13785 52 1 1
QUERY_FILE_INFORMATION 13785
WriteX 13785 0 491 491
Close 13785
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13786
ReadX 13786 0 491 491
WriteX 13783 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13781
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13787
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13787 0 4096 4096
ReadX 13787 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13789
Close 13789
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13790
WriteX 13790 52 1 1
QUERY_FILE_INFORMATION 13790
WriteX 13790 0 543 543
Close 13790
Close 13787
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13791
ReadX 13791 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13792
ReadX 13792 0 543 543
ReadX 13791 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13791
Close 13786
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13773
Close 13774
Close 13775
Close 13792
Close 13778
Close 13779
Close 13780
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13783
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13793
FIND_FIRST \clients\client1\~dmtmp\*
Close 13793
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13794
ReadX 13794 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13795
ReadX 13795 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13796
ReadX 13796 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13797
ReadX 13797 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13798
ReadX 13798 0 543 543
ReadX 13794 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13802
FIND_FIRST \clients\client1\~dmtmp\*
Close 13802
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13803
QUERY_FILE_INFORMATION 13803
WriteX 13803 2047 1 1
QUERY_FILE_INFORMATION 13803
WriteX 13803 0 2048 2048
Close 13803
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13804
ReadX 13804 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13804
Close 13794
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13805
ReadX 13805 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13805 4095 1 1
QUERY_FILE_INFORMATION 13805
ReadX 13805 0 4096 4096
WriteX 13805 0 4096 4096
Flush 13805
WriteX 13805 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13806
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13806 0 4096 4096
ReadX 13806 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13810
FIND_FIRST \clients\client1\~dmtmp\*
Close 13810
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13811
WriteX 13811 2047 1 1
QUERY_FILE_INFORMATION 13811
WriteX 13811 0 2048 2048
Close 13811
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13812
ReadX 13812 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13816
Close 13816
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13817
WriteX 13817 2047 1 1
QUERY_FILE_INFORMATION 13817
WriteX 13817 0 2048 2048
Close 13817
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13818
ReadX 13818 0 2048 2048
ReadX 13806 4096 16384 16384
Close 13818
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13819
ReadX 13819 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13819
Close 13798
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13812 4095 1 1
QUERY_FILE_INFORMATION 13812
ReadX 13812 0 4096 4096
WriteX 13812 0 4096 4096
Close 13812
WriteX 13806 0 8192 8192
Close 13806
WriteX 13795 0 4096 4096
WriteX 13796 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13821
ReadX 13821 0 4096 4096
ReadX 13821 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13821
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13822
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13822 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13823
ReadX 13823 0 543 543
ReadX 13822 0 4096 4096
Close 13822
Close 13805
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13824
QUERY_FILE_INFORMATION 13824
Close 13824
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13823
Close 13795
Close 13796
Close 13797
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13825
FIND_FIRST \clients\client1\~dmtmp\*
Close 13825
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13826
ReadX 13826 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13827
ReadX 13827 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13828
ReadX 13828 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13829
ReadX 13829 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13830
ReadX 13830 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13831
ReadX 13831 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13832
ReadX 13832 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13833
ReadX 13833 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13834
ReadX 13834 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13835
ReadX 13835 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13836
ReadX 13836 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13837
ReadX 13837 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13838
ReadX 13838 0 4096 4096
ReadX 13826 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13842
FIND_FIRST \clients\client1\~dmtmp\*
Close 13842
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13843
QUERY_FILE_INFORMATION 13843
WriteX 13843 2047 1 1
QUERY_FILE_INFORMATION 13843
WriteX 13843 0 2048 2048
Close 13843
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13844
ReadX 13844 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13844
Close 13834
Close 13826
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13845
ReadX 13845 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13846
FIND_FIRST \clients\client1\~dmtmp\*
Close 13846
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13847
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13847 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13848
ReadX 13848 0 4096 4096
ReadX 13847 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13852
FIND_FIRST \clients\client1\~dmtmp\*
Close 13852
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13853
QUERY_FILE_INFORMATION 13853
WriteX 13853 2047 1 1
QUERY_FILE_INFORMATION 13853
WriteX 13853 0 2048 2048
Close 13853
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13854
ReadX 13854 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13854
Close 13847
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13855
ReadX 13855 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13845 4095 1 1
QUERY_FILE_INFORMATION 13845
ReadX 13845 0 4096 4096
WriteX 13845 0 4096 4096
Flush 13845
WriteX 13855 4095 1 1
QUERY_FILE_INFORMATION 13855
ReadX 13855 0 4096 4096
WriteX 13855 0 4096 4096
Flush 13855
WriteX 13845 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 13855 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13856
ReadX 13856 0 4096 4096
ReadX 13848 0 4096 4096
ReadX 13856 0 4096 4096
ReadX 13856 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13857
FIND_FIRST \clients\client1\~dmtmp\*
Close 13857
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13858
WriteX 13858 4095 1 1
QUERY_FILE_INFORMATION 13858
WriteX 13858 0 4096 4096
Close 13858
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13859
ReadX 13859 0 4096 4096
Close 13856
Close 13848
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13860
Close 13860
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13861
WriteX 13861 4095 1 1
QUERY_FILE_INFORMATION 13861
WriteX 13861 0 4096 4096
Close 13861
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13862
ReadX 13862 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 13862 0 4096 4096
Close 13859
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13838
Close 13832
Close 13835
Close 13836
Close 13837
Close 13833
Close 13827
Close 13830
Close 13831
Close 13828
Close 13829
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13862
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13864
Close 13864
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13865
ReadX 13865 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13866
Close 13866
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13867
WriteX 13867 2047 1 1
QUERY_FILE_INFORMATION 13867
WriteX 13867 0 2048 2048
Close 13867
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13868
ReadX 13868 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13868
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13869
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13869 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13870
ReadX 13870 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13871
ReadX 13871 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13872
ReadX 13872 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13873
ReadX 13873 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13874
ReadX 13874 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13875
ReadX 13875 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13876
ReadX 13876 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13877
ReadX 13877 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13878
ReadX 13878 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13879
ReadX 13879 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13880
ReadX 13880 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13881
ReadX 13881 0 4096 4096
ReadX 13869 0 4096 4096
ReadX 13876 0 4096 4096
Close 13876
Close 13869
Close 13845
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13882
QUERY_FILE_INFORMATION 13882
Close 13882
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13865
Close 13880
Close 13875
Close 13877
Close 13878
Close 13879
Close 13881
Close 13870
Close 13873
Close 13874
Close 13871
Close 13872
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13855
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13883
QUERY_FILE_INFORMATION 13883
Close 13883
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13884
FIND_FIRST \clients\client1\~dmtmp\*
Close 13884
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13885
ReadX 13885 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13886
ReadX 13886 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13887
ReadX 13887 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13888
ReadX 13888 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13889
ReadX 13889 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13890
ReadX 13890 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13891
ReadX 13891 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13892
ReadX 13892 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13893
ReadX 13893 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13894
ReadX 13894 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13895
ReadX 13895 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13896
ReadX 13896 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13897
ReadX 13897 0 4096 4096
ReadX 13885 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13901
FIND_FIRST \clients\client1\~dmtmp\*
Close 13901
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13902
QUERY_FILE_INFORMATION 13902
WriteX 13902 2047 1 1
QUERY_FILE_INFORMATION 13902
WriteX 13902 0 2048 2048
Close 13902
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13903
ReadX 13903 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13903
Close 13885
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13904
ReadX 13904 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13905
FIND_FIRST \clients\client1\~dmtmp\*
Close 13905
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13906
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13906 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13907
ReadX 13907 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13908
ReadX 13908 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13909
ReadX 13909 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13910
ReadX 13910 0 543 543
ReadX 13906 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13914
FIND_FIRST \clients\client1\~dmtmp\*
Close 13914
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13915
QUERY_FILE_INFORMATION 13915
WriteX 13915 2047 1 1
QUERY_FILE_INFORMATION 13915
WriteX 13915 0 2048 2048
Close 13915
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13916
ReadX 13916 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13916
Close 13906
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13917
ReadX 13917 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 13890
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13918
FIND_FIRST \clients\client1\~dmtmp\*
Close 13918
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13919
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13919 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13920
ReadX 13920 0 4096 4096
ReadX 13919 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13924
FIND_FIRST \clients\client1\~dmtmp\*
Close 13924
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13925
QUERY_FILE_INFORMATION 13925
WriteX 13925 2047 1 1
QUERY_FILE_INFORMATION 13925
WriteX 13925 0 2048 2048
Close 13925
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13926
ReadX 13926 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13926
Close 13920
Close 13919
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13927
ReadX 13927 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13904 4095 1 1
QUERY_FILE_INFORMATION 13904
ReadX 13904 0 4096 4096
WriteX 13904 0 4096 4096
Flush 13904
WriteX 13917 4095 1 1
QUERY_FILE_INFORMATION 13917
ReadX 13917 0 4096 4096
WriteX 13917 0 4096 4096
Flush 13917
WriteX 13927 4095 1 1
QUERY_FILE_INFORMATION 13927
ReadX 13927 0 4096 4096
WriteX 13927 0 4096 4096
Flush 13927
WriteX 13904 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 13917 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 13927 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13928
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13928 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13929
ReadX 13929 0 4096 4096
ReadX 13928 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13930
ReadX 13930 0 4096 4096
ReadX 13930 0 4096 4096
ReadX 13930 4096 16384 16384
ReadX 13928 4096 16384 16384
ReadX 13928 0 4096 4096
ReadX 13929 0 4096 4096
ReadX 13929 4096 4096 4096
Close 13930
Close 13929
Close 13928
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13931
FIND_FIRST \clients\client1\~dmtmp\*
Close 13931
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13932
ReadX 13932 0 2048 2048
WriteX 13932 18431 1 1
QUERY_FILE_INFORMATION 13932
WriteX 13932 0 19584 19584
Close 13932
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13933
ReadX 13933 0 4096 4096
ReadX 13933 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13933
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13934
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13934 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13935
ReadX 13935 0 4096 4096
ReadX 13934 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13936
ReadX 13936 0 4096 4096
ReadX 13936 0 4096 4096
Close 13936
Close 13935
Close 13934
Close 13904
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13937
QUERY_FILE_INFORMATION 13937
Close 13937
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13910
Close 13897
Close 13889
Close 13907
Close 13908
Close 13909
Close 13896
Close 13891
Close 13894
Close 13895
Close 13892
Close 13893
Close 13886
Close 13887
Close 13888
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13917
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13938
QUERY_FILE_INFORMATION 13938
Close 13938
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13927
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13939
QUERY_FILE_INFORMATION 13939
Close 13939
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13940
FIND_FIRST \clients\client1\~dmtmp\*
Close 13940
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13941
ReadX 13941 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13942
ReadX 13942 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13943
ReadX 13943 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13944
ReadX 13944 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13945
ReadX 13945 0 543 543
ReadX 13941 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13941 4096 16384 16384
WriteX 13941 0 4096 4096
Close 13941
WriteX 13942 0 4096 4096
WriteX 13943 0 4096 4096
WriteX 13944 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13946
FIND_FIRST \clients\client1\~dmtmp\*
Close 13946
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13947
ReadX 13947 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13948
ReadX 13948 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13949
ReadX 13949 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13950
ReadX 13950 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13951
ReadX 13951 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13952
ReadX 13952 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13953
ReadX 13953 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13954
ReadX 13954 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13955
ReadX 13955 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13956
ReadX 13956 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13957
ReadX 13957 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13958
ReadX 13958 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13959
ReadX 13959 0 4096 4096
ReadX 13947 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13960
ReadX 13960 0 8192 8192
ReadX 13947 4096 16384 16384
Close 13954
Close 13947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13961
FIND_FIRST \clients\client1\~dmtmp\*
Close 13961
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13962
ReadX 13962 0 4096 4096
ReadX 13962 4096 4096 4096
ReadX 13962 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13963
ReadX 13963 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13964
ReadX 13964 0 4096 4096
ReadX 13963 0 4096 4096
ReadX 13963 0 4096 4096
ReadX 13963 4096 16384 16384
Close 13964
WriteX 13963 0 4096 4096
Close 13963
WriteX 13948 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13965
FIND_FIRST \clients\client1\~dmtmp\*
Close 13965
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13966
ReadX 13966 0 4096 4096
ReadX 13966 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13967
ReadX 13967 0 4096 4096
ReadX 13967 0 4096 4096
WriteX 13967 0 4096 4096
Close 13967
WriteX 13942 0 4096 4096
WriteX 13943 0 4096 4096
WriteX 13944 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13968
ReadX 13968 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13969
ReadX 13969 0 4096 4096
ReadX 13968 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13973
FIND_FIRST \clients\client1\~dmtmp\*
Close 13973
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13974
QUERY_FILE_INFORMATION 13974
WriteX 13974 2047 1 1
QUERY_FILE_INFORMATION 13974
WriteX 13974 0 2048 2048
Close 13974
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13975
ReadX 13975 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13975 4095 1 1
QUERY_FILE_INFORMATION 13975
ReadX 13975 0 4096 4096
WriteX 13975 0 4096 4096
Close 13975
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13976
ReadX 13976 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13976 0 4096 4096
Close 13969
Close 13968
WriteX 13976 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13977
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13977 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13978
ReadX 13978 0 4096 4096
ReadX 13977 0 4096 4096
ReadX 13977 4096 16384 16384
Close 13978
Close 13977
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13979
FIND_FIRST \clients\client1\~dmtmp\*
Close 13979
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13980
ReadX 13980 0 4096 4096
ReadX 13980 4096 4096 4096
WriteX 13980 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13980 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13980
ReadX 13976 0 4096 4096
WriteX 13976 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13981
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13981 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13982
ReadX 13982 0 4096 4096
ReadX 13981 0 4096 4096
ReadX 13981 4096 16384 16384
Close 13982
Close 13981
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13983
FIND_FIRST \clients\client1\~dmtmp\*
Close 13983
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13984
ReadX 13984 0 4096 4096
ReadX 13984 4096 4096 4096
WriteX 13984 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13984 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13984
Close 13976
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13985
QUERY_FILE_INFORMATION 13985
Close 13985
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13960
Close 13962
Close 13966
Close 13945
Close 13942
Close 13943
Close 13944
Close 13953
Close 13958
Close 13955
Close 13956
Close 13957
Close 13959
Close 13948
Close 13951
Close 13952
Close 13949
Close 13950
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13986
FIND_FIRST \clients\client1\~dmtmp\*
Close 13986
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13987
ReadX 13987 0 4096 4096
ReadX 13987 4096 4096 4096
ReadX 13987 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13988
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13988 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13989
ReadX 13989 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13990
ReadX 13990 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13991
ReadX 13991 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13992
ReadX 13992 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13993
ReadX 13993 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13994
ReadX 13994 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13995
ReadX 13995 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13996
ReadX 13996 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13997
ReadX 13997 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13998
ReadX 13998 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13999
ReadX 13999 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 14000
ReadX 14000 0 4096 4096
ReadX 13988 0 4096 4096
ReadX 13988 0 4096 4096
ReadX 13988 4096 16384 16384
Close 13995
Close 13988
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14001
ReadX 14001 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14002
ReadX 14002 0 4096 4096
ReadX 14001 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 14006
FIND_FIRST \clients\client1\~dmtmp\*
Close 14006
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 14007
QUERY_FILE_INFORMATION 14007
WriteX 14007 2047 1 1
QUERY_FILE_INFORMATION 14007
WriteX 14007 0 2048 2048
Close 14007
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 14008
ReadX 14008 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 14008 4095 1 1
QUERY_FILE_INFORMATION 14008
ReadX 14008 0 4096 4096
WriteX 14008 0 4096 4096
Close 14008
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 14009
ReadX 14009 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 14009 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 14013
Close 14013
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 14014
QUERY_FILE_INFORMATION 14014
WriteX 14014 2047 1 1
QUERY_FILE_INFORMATION 14014
WriteX 14014 0 2048 2048
Close 14014
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 14015
ReadX 14015 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 14015 4095 1 1
QUERY_FILE_INFORMATION 14015
ReadX 14015 0 4096 4096
WriteX 14015 0 4096 4096
Close 14015
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 14016
ReadX 14016 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 14016 0 4096 4096
Close 14001
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14017
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14017 0 4096 4096
ReadX 14017 0 4096 4096
ReadX 14017 4096 16384 16384
Close 14017
Close 14009
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 14018
QUERY_FILE_INFORMATION 14018
Close 14018
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13987
Close 13999
Close 13994
Close 14000
Close 14002
Close 13989
Close 13992
Close 13993
Close 13990
Close 13991
Close 13996
Close 13997
Close 13998
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 14016
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 14019
QUERY_FILE_INFORMATION 14019
Close 14019
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 14020
ReadX 14020 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 14021
Close 14021
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 14022
WriteX 14022 63 1 1
QUERY_FILE_INFORMATION 14022
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14020 0 4096 4096
ReadX 14020 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 14020 0 8192 8192
Flush 14020
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14020 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 14020 0 8192 8192
Flush 14020
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 14020 0 8192 8192
Flush 14020
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 14020 0 8192 8192
Flush 14020
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 14024
Close 14024
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 14026
WriteX 14026 4065 1 1
QUERY_FILE_INFORMATION 14026
WriteX 14026 0 62591 62591
Close 14026
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 14028
Close 14028
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 14030
WriteX 14030 4094 1 1
QUERY_FILE_INFORMATION 14030
WriteX 14030 0 10845 10845
Close 14030
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 14032
Close 14032
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 14034
WriteX 14034 4081 1 1
QUERY_FILE_INFORMATION 14034
WriteX 14034 0 30118 30118
Close 14034
WriteX 14020 0 4096 4096
Close 14020
WriteX 14022 0 64 64
Close 14022
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14035
ReadX 14035 61440 4096 4096
ReadX 14035 126976 4096 4096
WriteX 14035 0 65471 65471
WriteX 14035 65471 65 65
WriteX 14035 65536 65471 65471
WriteX 14035 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14036
ReadX 14036 61440 4096 4096
ReadX 14036 126976 4096 4096
ReadX 14036 192512 4096 4096
ReadX 14036 258048 4096 4096
WriteX 14036 0 65471 65471
WriteX 14036 65471 65 65
WriteX 14036 65536 65471 65471
WriteX 14036 131007 65 65
WriteX 14036 131072 65471 65471
WriteX 14036 196543 65 65
WriteX 14036 196608 65471 65471
WriteX 14036 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14037
ReadX 14037 61440 4096 4096
ReadX 14037 126976 4096 4096
ReadX 14037 192512 4096 4096
ReadX 14037 258048 4096 4096
ReadX 14037 323584 4096 4096
ReadX 14037 389120 4096 4096
ReadX 14037 454656 4096 4096
ReadX 14037 520192 4096 4096
WriteX 14037 0 65471 65471
WriteX 14037 65471 65 65
WriteX 14037 65536 65471 65471
WriteX 14037 131007 65 65
WriteX 14037 131072 65471 65471
WriteX 14037 196543 65 65
WriteX 14037 196608 65471 65471
WriteX 14037 262079 65 65
WriteX 14037 262144 65471 65471
WriteX 14037 327615 65 65
WriteX 14037 327680 65471 65471
WriteX 14037 393151 65 65
WriteX 14037 393216 65471 65471
WriteX 14037 458687 65 65
WriteX 14037 458752 65471 65471
WriteX 14037 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14038
Close 14038
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14035
Close 14036
Close 14037
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 14039
ReadX 14039 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 14040
ReadX 14040 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 14041
ReadX 14041 0 4096 4096
ReadX 14041 4096 4096 4096
ReadX 14041 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14042
Close 14042
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14039
Close 14040
Close 14041
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14043
Close 14043
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14044
ReadX 14044 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 14045
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 14045
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 14046
Close 14046
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 14047
ReadX 14047 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14048
Close 14048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14044
Close 14047
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14049
Close 14049
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14050
ReadX 14050 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 14051
ReadX 14051 0 8192 8192
ReadX 14051 8192 8192 8192
ReadX 14051 16384 8192 8192
ReadX 14051 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14053
Close 14053
Close 14050
Close 14051
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14055
WriteX 14055 8191 1 1
QUERY_FILE_INFORMATION 14055
WriteX 14055 0 10438 10438
Close 14055
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14056
Close 14056
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14057
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14058
Close 14058
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14059
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14060
Close 14060
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14061
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14062
FIND_FIRST \clients\client1\~dmtmp\*
Close 14062
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14063
Close 14063
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14064
ReadX 14064 0 4096 4096
Close 14064
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14065
ReadX 14065 0 8192 8192
Close 14065
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14066
ReadX 14066 0 8192 8192
ReadX 14066 8192 4096 4096
ReadX 14066 12288 8192 8192
ReadX 14066 20480 8192 8192
ReadX 14066 28672 8192 8192
ReadX 14066 36864 8192 8192
ReadX 14066 45056 8192 8192
ReadX 14066 53248 8192 8192
ReadX 14066 61440 8192 8192
ReadX 14066 69632 8192 8192
ReadX 14066 77824 8192 8192
ReadX 14066 86016 8192 8192
ReadX 14066 94208 8192 8192
ReadX 14066 102400 8192 8192
ReadX 14066 110592 8192 8192
ReadX 14066 118784 8192 8192
ReadX 14066 126976 8192 8192
ReadX 14066 135168 8192 8192
ReadX 14066 143360 8192 8192
ReadX 14066 151552 8192 8192
ReadX 14066 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 14067
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14067
Close 14066
Close 14057
Close 14059
Close 14061
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 14068
Close 14068
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14070
WriteX 14070 8191 1 1
QUERY_FILE_INFORMATION 14070
WriteX 14070 0 28489 28489
Close 14070
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14071
Close 14071
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14072
FIND_FIRST \clients\client1\~dmtmp\*
Close 14072
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14073
Close 14073
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14074
ReadX 14074 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14075
Close 14075
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14074
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14076
Close 14076
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14077
ReadX 14077 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14078
ReadX 14078 0 8192 8192
ReadX 14078 8192 8192 8192
ReadX 14078 16384 8192 8192
ReadX 14078 24576 8192 8192
ReadX 14078 32768 16384 16384
ReadX 14078 49152 8192 8192
ReadX 14078 57344 8192 8192
ReadX 14078 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14080
Close 14080
Close 14077
Close 14078
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14082
WriteX 14082 8191 1 1
QUERY_FILE_INFORMATION 14082
WriteX 14082 0 29253 29253
Close 14082
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14083
Close 14083
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14084
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 14085
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14085
Close 14084
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 14086
Close 14086
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14088
WriteX 14088 8191 1 1
QUERY_FILE_INFORMATION 14088
WriteX 14088 0 30183 30183
Close 14088
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14089
Close 14089
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 14090
WriteX 14090 0 510 510
WriteX 14090 510 512 512
WriteX 14090 1022 510 510
WriteX 14090 1532 510 510
WriteX 14090 2042 168 168
Close 14090
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14091
Close 14091
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 14092
ReadX 14092 0 4096 4096
WriteX 14092 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14093
ReadX 14093 0 65471 65471
ReadX 14093 65471 65 65
ReadX 14093 65536 65471 65471
ReadX 14093 131007 65 65
ReadX 14093 131072 65471 65471
ReadX 14093 196543 65 65
ReadX 14093 196608 65471 65471
ReadX 14093 262079 65 65
ReadX 14093 262144 65471 65471
ReadX 14093 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14094
ReadX 14094 0 65471 65471
ReadX 14094 65471 65 65
ReadX 14094 65536 65471 65471
ReadX 14094 131007 65 65
ReadX 14094 131072 65471 65471
ReadX 14094 196543 65 65
ReadX 14094 196608 65471 65471
ReadX 14094 262079 65 65
ReadX 14094 262144 65471 65471
ReadX 14094 327615 65 65
ReadX 14094 327680 65471 65471
ReadX 14094 393151 65 65
ReadX 14094 393216 65471 65471
ReadX 14094 458687 65 65
ReadX 14094 458752 65471 65471
ReadX 14094 524223 65 65
ReadX 14094 524288 65471 65471
ReadX 14094 589759 65 65
ReadX 14094 589824 65471 65471
ReadX 14094 655295 65 65
ReadX 14094 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14095
ReadX 14095 0 65471 65471
ReadX 14095 65471 65 65
ReadX 14095 65536 65471 65471
ReadX 14095 131007 65 65
ReadX 14095 131072 65471 65471
ReadX 14095 196543 65 65
ReadX 14095 196608 65471 65471
ReadX 14095 262079 65 65
ReadX 14095 262144 65471 65471
ReadX 14095 327615 65 65
ReadX 14095 327680 65471 65471
ReadX 14095 393151 65 65
ReadX 14095 393216 65471 65471
ReadX 14095 458687 65 65
ReadX 14095 458752 65471 65471
ReadX 14095 524223 65 65
ReadX 14095 524288 65471 65471
ReadX 14095 589759 65 65
ReadX 14095 589824 65471 65471
ReadX 14095 655295 65 65
ReadX 14095 655360 65471 65471
ReadX 14095 720831 65 65
ReadX 14095 720896 65471 65471
ReadX 14095 786367 65 65
ReadX 14095 786432 65471 65471
ReadX 14095 851903 65 65
ReadX 14095 851968 65471 65471
ReadX 14095 917439 65 65
ReadX 14095 917504 65471 65471
ReadX 14095 982975 65 65
ReadX 14095 983040 65471 65471
ReadX 14095 1048511 65 65
ReadX 14095 1048576 65471 65471
ReadX 14095 1114047 65 65
ReadX 14095 1114112 65471 65471
ReadX 14095 1179583 65 65
ReadX 14095 1179648 65471 65471
ReadX 14095 1245119 65 65
ReadX 14095 1245184 65471 65471
ReadX 14095 1310655 65 65
ReadX 14095 1310720 65471 65471
ReadX 14095 1376191 65 65
ReadX 14095 1376256 65471 65471
ReadX 14095 1441727 65 65
ReadX 14095 1441792 65471 65471
ReadX 14095 1507263 65 65
ReadX 14095 1507328 65471 65471
ReadX 14095 1572799 65 65
ReadX 14095 1572864 65471 65471
ReadX 14095 1638335 65 65
ReadX 14095 1638400 65471 65471
ReadX 14095 1703871 65 65
ReadX 14095 1703936 65471 65471
ReadX 14095 1769407 65 65
ReadX 14095 1769472 65471 65471
ReadX 14095 1834943 65 65
ReadX 14095 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13565
ReadX 13565 0 4096 4096
ReadX 13565 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13566
WriteX 13566 52 1 1
QUERY_FILE_INFORMATION 13566
WriteX 13566 0 53 53
Close 13566
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13567
Close 13567
Close 14092
Close 14093
Close 14094
Close 14095
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13565 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13568
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13565 0 4096 4096
ReadX 13565 4096 4096 4096
ReadX 13565 8192 4096 4096
ReadX 13565 12288 4096 4096
WriteX 13568 15359 1 1
QUERY_FILE_INFORMATION 13568
ReadX 13565 16384 4096 4096
ReadX 13565 20480 4096 4096
WriteX 13568 0 15360 15360
Close 13568
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13569
ReadX 13569 0 4096 4096
WriteX 13569 0 4096 4096
Close 13569
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13570
Close 13570
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13571
ReadX 13571 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13572
Close 13572
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13565
ReadX 13571 0 4096 4096
ReadX 13571 4096 4096 4096
ReadX 13571 8192 4096 4096
ReadX 13571 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13573
ReadX 13573 0 4096 4096
ReadX 13573 0 4096 4096
ReadX 13573 4096 4096 4096
ReadX 13573 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13574
ReadX 13574 0 4096 4096
ReadX 13574 4096 4096 4096
ReadX 13574 8192 4096 4096
Close 13573
Close 13574
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13575
WriteX 13575 15359 1 1
QUERY_FILE_INFORMATION 13575
WriteX 13575 0 15360 15360
Close 13575
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13576
ReadX 13576 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13571
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13577
Close 13577
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13578
ReadX 13578 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13579
Close 13579
WriteX 13576 0 4096 4096
Close 13576
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13580
Close 13580
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13581
ReadX 13581 0 4096 4096
ReadX 13581 0 4096 4096
ReadX 13581 4096 4096 4096
ReadX 13581 8192 4096 4096
ReadX 13581 12288 3072 3072
ReadX 13581 0 8192 8192
ReadX 13581 8192 4096 4096
ReadX 13581 12288 3072 3072
WriteX 13581 15469 1 1
QUERY_FILE_INFORMATION 13581
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13582
ReadX 13582 0 4096 4096
ReadX 13582 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13583
WriteX 13583 52 1 1
QUERY_FILE_INFORMATION 13583
WriteX 13583 0 53 53
Close 13583
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13584
Close 13584
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13585
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13582 0 8192 8192
ReadX 13582 8192 4096 4096
ReadX 13582 12288 4096 4096
WriteX 13585 12005 1 1
QUERY_FILE_INFORMATION 13585
WriteX 13585 0 12006 12006
Close 13585
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13586
ReadX 13586 0 4096 4096
WriteX 13586 0 4096 4096
Close 13586
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13587
Close 13587
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13588
ReadX 13588 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13589
Close 13589
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13582
ReadX 13588 0 4096 4096
ReadX 13588 4096 4096 4096
ReadX 13588 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13590
WriteX 13590 11990 1 1
QUERY_FILE_INFORMATION 13590
WriteX 13590 0 11991 11991
Close 13590
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13591
ReadX 13591 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13588
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13592
Close 13592
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13593
ReadX 13593 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13594
Close 13594
WriteX 13591 0 4096 4096
Close 13591
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13595
Close 13595
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13596
ReadX 13596 0 4096 4096
ReadX 13596 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13597
Close 13597
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13596 0 8192 8192
ReadX 13596 8192 3799 3799
WriteX 13596 13247 1 1
QUERY_FILE_INFORMATION 13596
WriteX 13596 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13596 0 8192 8192
ReadX 13596 8192 4096 4096
Close 13578
WriteX 13581 0 19054 19054
Close 13581
WriteX 13596 0 12288 12288
Close 13596
Close 13593
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13598
Close 13598
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13599
Close 13599
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13600
ReadX 13600 61440 4096 4096
ReadX 13600 126976 4096 4096
WriteX 13600 0 65471 65471
WriteX 13600 65471 65 65
WriteX 13600 65536 65471 65471
WriteX 13600 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13601
ReadX 13601 61440 4096 4096
ReadX 13601 126976 4096 4096
ReadX 13601 192512 4096 4096
ReadX 13601 258048 4096 4096
WriteX 13601 0 65471 65471
WriteX 13601 65471 65 65
WriteX 13601 65536 65471 65471
WriteX 13601 131007 65 65
WriteX 13601 131072 65471 65471
WriteX 13601 196543 65 65
WriteX 13601 196608 65471 65471
WriteX 13601 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13602
ReadX 13602 61440 4096 4096
ReadX 13602 126976 4096 4096
ReadX 13602 192512 4096 4096
ReadX 13602 258048 4096 4096
ReadX 13602 323584 4096 4096
ReadX 13602 389120 4096 4096
ReadX 13602 454656 4096 4096
ReadX 13602 520192 4096 4096
WriteX 13602 0 65471 65471
WriteX 13602 65471 65 65
WriteX 13602 65536 65471 65471
WriteX 13602 131007 65 65
WriteX 13602 131072 65471 65471
WriteX 13602 196543 65 65
WriteX 13602 196608 65471 65471
WriteX 13602 262079 65 65
WriteX 13602 262144 65471 65471
WriteX 13602 327615 65 65
WriteX 13602 327680 65471 65471
WriteX 13602 393151 65 65
WriteX 13602 393216 65471 65471
WriteX 13602 458687 65 65
WriteX 13602 458752 65471 65471
WriteX 13602 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13603
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13603 0 4096 4096
Close 13603
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13604
ReadX 13604 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13604
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13605
ReadX 13605 0 4096 4096
ReadX 13605 4096 4096 4096
ReadX 13605 8192 4096 4096
ReadX 13605 12288 4096 4096
ReadX 13605 16384 4096 4096
ReadX 13605 20480 4096 4096
ReadX 13605 24576 4096 4096
ReadX 13605 28672 4096 4096
ReadX 13605 32768 4096 4096
ReadX 13605 36864 4096 4096
ReadX 13605 40960 4096 4096
ReadX 13605 45056 4096 4096
ReadX 13605 49152 4096 4096
ReadX 13605 53248 4096 4096
ReadX 13605 57344 4096 4096
ReadX 13605 61440 4096 4096
ReadX 13605 65536 4096 4096
ReadX 13605 69632 4096 4096
ReadX 13605 73728 4096 4096
WriteX 13605 0 4096 4096
Close 13605
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13606
Close 13606
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13607
ReadX 13607 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13608
Close 13608
Close 13600
Close 13601
Close 13602
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13607
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13610
WriteX 13610 4607 1 1
QUERY_FILE_INFORMATION 13610
WriteX 13610 0 65471 65471
WriteX 13610 65471 65 65
WriteX 13610 65536 19979 19979
Close 13610
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13611
ReadX 13611 0 4096 4096
WriteX 13611 0 4096 4096
Flush 13611
WriteX 13611 0 4096 4096
Flush 13611
QUERY_FILE_INFORMATION 13611
WriteX 13611 0 4096 4096
Flush 13611
WriteX 13611 0 4096 4096
Flush 13611
WriteX 13611 0 4096 4096
Flush 13611
WriteX 13611 0 4096 4096
Flush 13611
Close 13611
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13612
ReadX 13612 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13613
ReadX 13613 0 4096 4096
Close 13612
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13614
ReadX 13614 0 4096 4096
Close 13614
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13615
ReadX 13615 0 4096 4096
Close 13615
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13616
ReadX 13616 0 4096 4096
WriteX 13616 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13617
Close 13617
Close 13613
Close 13616
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13618
Close 13618
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13620
WriteX 13620 4607 1 1
QUERY_FILE_INFORMATION 13620
WriteX 13620 0 65471 65471
WriteX 13620 65471 65 65
WriteX 13620 65536 17654 17654
Close 13620
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13621
ReadX 13621 0 4096 4096
WriteX 13621 0 4096 4096
Flush 13621
WriteX 13621 0 4096 4096
Flush 13621
QUERY_FILE_INFORMATION 13621
WriteX 13621 0 4096 4096
Flush 13621
WriteX 13621 0 4096 4096
Flush 13621
WriteX 13621 0 4096 4096
Flush 13621
WriteX 13621 0 4096 4096
Flush 13621
Close 13621
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13622
Close 13622
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13623
ReadX 13623 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13624
Close 13624
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13625
ReadX 13625 0 4096 4096
ReadX 13625 4096 4096 4096
ReadX 13625 8192 4096 4096
ReadX 13625 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13625 16384 4096 4096
ReadX 13625 20480 4096 4096
ReadX 13625 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13623
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13626
ReadX 13626 0 4096 4096
Close 13626
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13627
ReadX 13627 0 4096 4096
Close 13627
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13628
ReadX 13628 0 4096 4096
WriteX 13628 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13629
Close 13629
Close 13628
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13630
Close 13630
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13632
WriteX 13632 4607 1 1
QUERY_FILE_INFORMATION 13632
WriteX 13632 0 65471 65471
WriteX 13632 65471 65 65
WriteX 13632 65536 19490 19490
Close 13632
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13633
ReadX 13633 0 4096 4096
WriteX 13633 0 4096 4096
Flush 13633
WriteX 13633 0 4096 4096
Flush 13633
QUERY_FILE_INFORMATION 13633
WriteX 13633 0 4096 4096
Flush 13633
WriteX 13633 0 4096 4096
Flush 13633
WriteX 13633 0 4096 4096
Flush 13633
WriteX 13633 0 4096 4096
Flush 13633
Close 13633
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13634
Close 13634
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13635
ReadX 13635 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13636
Close 13636
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13635
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13637
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13637 0 4096 4096
Close 13637
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13638
ReadX 13638 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13638
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13639
ReadX 13639 0 4096 4096
ReadX 13639 4096 4096 4096
ReadX 13639 8192 4096 4096
ReadX 13639 12288 4096 4096
ReadX 13639 16384 4096 4096
ReadX 13639 20480 4096 4096
ReadX 13639 24576 4096 4096
ReadX 13639 28672 4096 4096
ReadX 13639 32768 4096 4096
ReadX 13639 36864 4096 4096
ReadX 13639 40960 4096 4096
ReadX 13639 45056 4096 4096
ReadX 13639 49152 4096 4096
ReadX 13639 53248 4096 4096
ReadX 13639 57344 4096 4096
ReadX 13639 61440 4096 4096
ReadX 13639 65536 4096 4096
ReadX 13639 69632 4096 4096
ReadX 13639 73728 4096 4096
WriteX 13639 0 4096 4096
Close 13639
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13640
Close 13640
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13641
ReadX 13641 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13642
Close 13642
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13641
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13644
WriteX 13644 4607 1 1
QUERY_FILE_INFORMATION 13644
WriteX 13644 0 65471 65471
WriteX 13644 65471 65 65
WriteX 13644 65536 8866 8866
Close 13644
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13645
ReadX 13645 0 4096 4096
WriteX 13645 0 4096 4096
Flush 13645
WriteX 13645 0 4096 4096
Flush 13645
Close 13645
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13646
ReadX 13646 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13646
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13647
ReadX 13647 0 4096 4096
Close 13647
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13648
ReadX 13648 0 4096 4096
Close 13648
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13649
ReadX 13649 0 4096 4096
WriteX 13649 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13650
Close 13650
Close 13649
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13651
Close 13651
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13653
WriteX 13653 4607 1 1
QUERY_FILE_INFORMATION 13653
WriteX 13653 0 65471 65471
WriteX 13653 65471 65 65
WriteX 13653 65536 9298 9298
Close 13653
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13654
ReadX 13654 0 4096 4096
WriteX 13654 0 4096 4096
Flush 13654
WriteX 13654 0 4096 4096
Flush 13654
Close 13654
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13655
Close 13655
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13656
ReadX 13656 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13657
Close 13657
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13659
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13659 0 4096 4096
Close 13659
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13660
ReadX 13660 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13660 4096 4096 4096
ReadX 13660 8192 4096 4096
ReadX 13660 12288 4096 4096
ReadX 13660 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13656
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13661
ReadX 13661 0 4096 4096
Close 13661
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13662
ReadX 13662 0 4096 4096
Close 13662
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13663
ReadX 13663 0 4096 4096
WriteX 13663 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13664
Close 13664
Close 13660
Close 13663
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13665
Close 13665
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13667
WriteX 13667 4607 1 1
QUERY_FILE_INFORMATION 13667
WriteX 13667 0 65471 65471
WriteX 13667 65471 65 65
WriteX 13667 65536 11540 11540
Close 13667
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13668
ReadX 13668 0 4096 4096
WriteX 13668 0 4096 4096
Flush 13668
WriteX 13668 0 4096 4096
Flush 13668
Close 13668
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13669
Close 13669
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13670
ReadX 13670 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13671
Close 13671
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13670
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13672
ReadX 13672 0 65471 65471
ReadX 13672 65471 65 65
ReadX 13672 65536 65471 65471
ReadX 13672 131007 65 65
ReadX 13672 131072 65471 65471
ReadX 13672 196543 65 65
ReadX 13672 196608 65471 65471
ReadX 13672 262079 65 65
ReadX 13672 262144 65471 65471
ReadX 13672 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13673
ReadX 13673 0 65471 65471
ReadX 13673 65471 65 65
ReadX 13673 65536 65471 65471
ReadX 13673 131007 65 65
ReadX 13673 131072 65471 65471
ReadX 13673 196543 65 65
ReadX 13673 196608 65471 65471
ReadX 13673 262079 65 65
ReadX 13673 262144 65471 65471
ReadX 13673 327615 65 65
ReadX 13673 327680 65471 65471
ReadX 13673 393151 65 65
ReadX 13673 393216 65471 65471
ReadX 13673 458687 65 65
ReadX 13673 458752 65471 65471
ReadX 13673 524223 65 65
ReadX 13673 524288 65471 65471
ReadX 13673 589759 65 65
ReadX 13673 589824 65471 65471
ReadX 13673 655295 65 65
ReadX 13673 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13674
ReadX 13674 0 65471 65471
ReadX 13674 65471 65 65
ReadX 13674 65536 65471 65471
ReadX 13674 131007 65 65
ReadX 13674 131072 65471 65471
ReadX 13674 196543 65 65
ReadX 13674 196608 65471 65471
ReadX 13674 262079 65 65
ReadX 13674 262144 65471 65471
ReadX 13674 327615 65 65
ReadX 13674 327680 65471 65471
ReadX 13674 393151 65 65
ReadX 13674 393216 65471 65471
ReadX 13674 458687 65 65
ReadX 13674 458752 65471 65471
ReadX 13674 524223 65 65
ReadX 13674 524288 65471 65471
ReadX 13674 589759 65 65
ReadX 13674 589824 65471 65471
ReadX 13674 655295 65 65
ReadX 13674 655360 65471 65471
ReadX 13674 720831 65 65
ReadX 13674 720896 65471 65471
ReadX 13674 786367 65 65
ReadX 13674 786432 65471 65471
ReadX 13674 851903 65 65
ReadX 13674 851968 65471 65471
ReadX 13674 917439 65 65
ReadX 13674 917504 65471 65471
ReadX 13674 982975 65 65
ReadX 13674 983040 65471 65471
ReadX 13674 1048511 65 65
ReadX 13674 1048576 65471 65471
ReadX 13674 1114047 65 65
ReadX 13674 1114112 65471 65471
ReadX 13674 1179583 65 65
ReadX 13674 1179648 65471 65471
ReadX 13674 1245119 65 65
ReadX 13674 1245184 65471 65471
ReadX 13674 1310655 65 65
ReadX 13674 1310720 65471 65471
ReadX 13674 1376191 65 65
ReadX 13674 1376256 65471 65471
ReadX 13674 1441727 65 65
ReadX 13674 1441792 65471 65471
ReadX 13674 1507263 65 65
ReadX 13674 1507328 65471 65471
ReadX 13674 1572799 65 65
ReadX 13674 1572864 65471 65471
ReadX 13674 1638335 65 65
ReadX 13674 1638400 65471 65471
ReadX 13674 1703871 65 65
ReadX 13674 1703936 65471 65471
ReadX 13674 1769407 65 65
ReadX 13674 1769472 65471 65471
ReadX 13674 1834943 65 65
ReadX 13674 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13675
FIND_FIRST \clients\client1\~dmtmp\*
Close 13675
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13676
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13677
QUERY_FILE_INFORMATION 13677
QUERY_FILE_INFORMATION 13677
QUERY_FILE_INFORMATION 13677
ReadX 13677 2156 24 24
ReadX 13677 2139 276 276
ReadX 13677 2136 14 14
ReadX 13677 2136 7 7
ReadX 13677 2138 12 12
ReadX 13677 2137 8 8
ReadX 13677 2135 15 15
ReadX 13677 0 16 16
ReadX 13677 16 2048 2048
ReadX 13677 2064 2048 2048
ReadX 13677 257 2048 2048
ReadX 13677 385 2048 2048
ReadX 13677 513 2048 2048
ReadX 13677 641 2048 2048
ReadX 13677 769 2048 2048
ReadX 13677 897 2048 2048
ReadX 13677 1025 2048 2048
ReadX 13677 1153 2048 2048
ReadX 13677 1281 2048 2048
ReadX 13677 1409 2048 2048
ReadX 13677 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13679
Close 13679
Close 13625
Close 13672
Close 13673
Close 13674
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13681
WriteX 13681 15 1 1
QUERY_FILE_INFORMATION 13681
WriteX 13681 0 10575 10575
Flush 13681
Close 13681
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13682
Close 13682
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13683
ReadX 13683 0 4096 4096
Close 13677
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13684
Close 13684
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13685
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13686
QUERY_FILE_INFORMATION 13686
ReadX 13686 0 512 512
ReadX 13686 512 512 512
ReadX 13686 1024 512 512
QUERY_FILE_INFORMATION 13686
QUERY_FILE_INFORMATION 13686
Close 13686
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13687
QUERY_FILE_INFORMATION 13687
ReadX 13687 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13688
QUERY_FILE_INFORMATION 13688
ReadX 13688 0 512 512
ReadX 13688 512 512 512
ReadX 13688 1024 512 512
ReadX 13688 288 20 20
ReadX 13688 308 2084 2084
ReadX 13688 388 2084 2084
ReadX 13688 388 2084 2084
ReadX 13676 2157 1386 1386
ReadX 13688 2472 399 399
ReadX 13688 3072 1536 1536
ReadX 13688 544 149 149
ReadX 13688 693 485 485
Close 13688
ReadX 13676 2157 4096 4096
ReadX 13676 6253 4096 4096
ReadX 13676 10349 4096 4096
ReadX 13676 14445 4096 4096
ReadX 13676 18541 4096 4096
ReadX 13676 22637 256 256
ReadX 13676 22893 4096 4096
ReadX 13676 26989 4096 4096
ReadX 13676 31085 4096 4096
ReadX 13676 35181 4096 4096
ReadX 13676 39277 4096 4096
ReadX 13676 43373 4096 4096
ReadX 13676 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13676 2157 1024 1024
ReadX 13676 1667 4688 4688
ReadX 13676 6355 3516 3516
ReadX 13676 9871 16384 16384
ReadX 13676 26255 3771 3771
ReadX 13676 30026 2048 2048
ReadX 13676 32074 1024 1024
ReadX 13676 33098 6652 6652
ReadX 13676 39750 16384 16384
ReadX 13676 56134 10496 10496
ReadX 13676 66630 1784 1784
ReadX 13676 68414 90 90
ReadX 13676 68504 273 273
ReadX 13676 68777 1600 1600
ReadX 13676 70377 640 640
ReadX 13676 71017 1280 1280
ReadX 13676 72297 8464 8464
ReadX 13676 80761 158 158
ReadX 13676 80919 912 912
ReadX 13676 81831 1980 1980
ReadX 13676 83811 2256 2256
ReadX 13676 86067 400 400
ReadX 13676 86467 252 252
ReadX 13676 86719 42 42
ReadX 13676 86761 725 725
ReadX 13676 2009 512 512
ReadX 13676 3895 9 9
ReadX 13676 3781 46 46
ReadX 13676 4059 92 92
ReadX 13676 3781 92 92
ReadX 13676 3986 184 184
ReadX 13676 3987 16384 16384
ReadX 13676 3902 16384 16384
ReadX 13676 3781 10240 10240
ReadX 13676 3821 16384 16384
ReadX 13676 3891 935 935
ReadX 13676 4060 10240 10240
ReadX 13676 4059 184 184
ReadX 13676 256 184 184
ReadX 13676 256 1026 1026
ReadX 13676 3901 326 326
ReadX 13676 3899 652 652
ReadX 13676 256 2 2
ReadX 13676 258 4948 4948
Close 13676
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13690
Close 13690
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13692
WriteX 13692 4055 1 1
QUERY_FILE_INFORMATION 13692
WriteX 13692 0 65471 65471
WriteX 13692 65471 65 65
WriteX 13692 65536 65471 65471
WriteX 13692 131007 65 65
WriteX 13692 131072 65471 65471
WriteX 13692 196543 65 65
WriteX 13692 196608 65471 65471
WriteX 13692 262079 65 65
WriteX 13692 262144 65471 65471
WriteX 13692 327615 65 65
WriteX 13692 327680 65471 65471
WriteX 13692 393151 65 65
WriteX 13692 393216 65471 65471
WriteX 13692 458687 65 65
WriteX 13692 458752 65471 65471
WriteX 13692 524223 65 65
WriteX 13692 524288 65471 65471
WriteX 13692 589759 65 65
WriteX 13692 589824 35257 35257
Close 13692
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13694
Close 13694
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13696
WriteX 13696 4055 1 1
QUERY_FILE_INFORMATION 13696
WriteX 13696 0 65471 65471
WriteX 13696 65471 65 65
WriteX 13696 65536 65471 65471
WriteX 13696 131007 65 65
WriteX 13696 131072 65471 65471
WriteX 13696 196543 65 65
WriteX 13696 196608 65471 65471
WriteX 13696 262079 65 65
WriteX 13696 262144 65471 65471
WriteX 13696 327615 65 65
WriteX 13696 327680 65471 65471
WriteX 13696 393151 65 65
WriteX 13696 393216 65471 65471
WriteX 13696 458687 65 65
WriteX 13696 458752 65471 65471
WriteX 13696 524223 65 65
WriteX 13696 524288 65471 65471
WriteX 13696 589759 65 65
WriteX 13696 589824 57598 57598
Close 13696
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13698
WriteX 13698 15 1 1
QUERY_FILE_INFORMATION 13698
WriteX 13698 0 12543 12543
Flush 13698
Close 13698
Close 13683
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13699
Close 13699
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13700
ReadX 13700 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13701
FIND_FIRST \clients\client1\~dmtmp\*
Close 13701
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13702
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13703
QUERY_FILE_INFORMATION 13703
QUERY_FILE_INFORMATION 13703
QUERY_FILE_INFORMATION 13703
ReadX 13703 1938 24 24
ReadX 13703 1920 276 276
ReadX 13703 1918 14 14
ReadX 13703 1918 7 7
ReadX 13703 1919 12 12
ReadX 13703 1919 8 8
ReadX 13703 1917 15 15
ReadX 13703 0 16 16
ReadX 13703 16 2048 2048
ReadX 13703 2064 2048 2048
ReadX 13703 257 2048 2048
ReadX 13703 385 2048 2048
ReadX 13703 513 2048 2048
ReadX 13703 641 2048 2048
ReadX 13703 769 2048 2048
ReadX 13703 897 2048 2048
ReadX 13703 1025 2048 2048
ReadX 13703 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13705
Close 13705
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13707
WriteX 13707 15 1 1
QUERY_FILE_INFORMATION 13707
WriteX 13707 0 11588 11588
Flush 13707
Close 13707
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13708
Close 13708
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13709
ReadX 13709 0 4096 4096
Close 13703
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13711
WriteX 13711 15 1 1
QUERY_FILE_INFORMATION 13711
WriteX 13711 0 11615 11615
Flush 13711
Close 13711
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13709
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13712
Close 13712
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13713
ReadX 13713 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13715
Close 13715
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13717
WriteX 13717 4088 1 1
QUERY_FILE_INFORMATION 13717
WriteX 13717 0 65471 65471
WriteX 13717 65471 65 65
WriteX 13717 65536 16050 16050
Close 13717
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13702 1939 64 64
ReadX 13702 128 248 248
ReadX 13702 128 568 568
ReadX 13702 3872 1536 1536
ReadX 13702 3456 2560 2560
ReadX 13702 3136 512 512
ReadX 13702 2880 4096 4096
ReadX 13702 3264 3072 3072
ReadX 13702 320 4096 4096
ReadX 13702 1024 4096 4096
ReadX 13702 3616 4096 4096
ReadX 13702 1939 64 64
ReadX 13702 128 248 248
ReadX 13702 128 608 608
ReadX 13702 2858 1024 1024
ReadX 13702 2810 4096 4096
ReadX 13702 2826 4096 4096
ReadX 13702 2580 2048 2048
ReadX 13702 2800 2560 2560
ReadX 13702 2100 4096 4096
ReadX 13702 2084 4096 4096
ReadX 13702 868 4096 4096
ReadX 13702 2324 4096 4096
ReadX 13702 884 4096 4096
ReadX 13702 2604 1024 1024
ReadX 13702 580 4096 4096
ReadX 13702 596 4096 4096
ReadX 13702 2752 4096 4096
ReadX 13702 2842 1024 1024
ReadX 13702 660 4096 4096
ReadX 13702 2720 4096 4096
ReadX 13702 2736 4096 4096
ReadX 13702 628 4096 4096
ReadX 13702 2704 4096 4096
ReadX 13702 1556 4096 4096
ReadX 13702 576 4096 4096
ReadX 13702 3168 1536 1536
ReadX 13702 832 4096 4096
ReadX 13702 1088 4096 4096
ReadX 13702 1344 4096 4096
ReadX 13702 1600 4096 4096
ReadX 13702 1856 4096 4096
ReadX 13702 2112 4096 4096
ReadX 13702 1892 4096 4096
ReadX 13702 820 4096 4096
ReadX 13702 788 4096 4096
ReadX 13702 1604 4096 4096
ReadX 13702 3648 4096 4096
ReadX 13702 2608 4096 4096
ReadX 13702 548 4096 4096
ReadX 13702 740 4096 4096
ReadX 13702 1344 4096 4096
ReadX 13702 3392 4096 4096
ReadX 13702 3904 4096 4096
ReadX 13702 644 4096 4096
ReadX 13702 676 4096 4096
ReadX 13702 2688 4096 4096
ReadX 13702 320 4096 4096
ReadX 13702 900 4096 4096
ReadX 13702 1908 4096 4096
ReadX 13702 852 4096 4096
ReadX 13702 724 4096 4096
ReadX 13702 2292 4096 4096
ReadX 13702 612 4096 4096
ReadX 13702 388 4096 4096
ReadX 13702 2368 4096 4096
ReadX 13702 2624 4096 4096
ReadX 13702 500 4096 4096
ReadX 13702 356 4096 4096
ReadX 13702 1024 4096 4096
ReadX 13702 576 4096 4096
ReadX 13702 340 4096 4096
ReadX 13702 420 4096 4096
ReadX 13702 1600 4096 4096
ReadX 13702 404 4096 4096
ReadX 13702 1428 4096 4096
ReadX 13702 2656 4096 4096
ReadX 13702 2624 4096 4096
ReadX 13702 452 4096 4096
ReadX 13702 692 4096 4096
ReadX 13702 564 4096 4096
ReadX 13702 372 4096 4096
ReadX 13702 468 4096 4096
ReadX 13702 484 4096 4096
ReadX 13702 1088 4096 4096
ReadX 13702 1924 4096 4096
ReadX 13702 2768 4096 4096
ReadX 13702 832 4096 4096
ReadX 13702 836 4096 4096
ReadX 13702 1856 4096 4096
ReadX 13702 2640 4096 4096
ReadX 13702 436 4096 4096
ReadX 13702 1828 4096 4096
ReadX 13702 804 4096 4096
ReadX 13702 1860 4096 4096
ReadX 13702 1812 4096 4096
ReadX 13702 756 4096 4096
ReadX 13702 1636 4096 4096
ReadX 13702 772 4096 4096
ReadX 13702 2036 4096 4096
ReadX 13702 1220 4096 4096
ReadX 13702 1652 4096 4096
ReadX 13702 2588 4096 4096
ReadX 13702 916 4096 4096
ReadX 13702 260 4096 4096
ReadX 13702 932 4096 4096
ReadX 13702 2624 4096 4096
ReadX 13702 308 4096 4096
ReadX 13702 292 4096 4096
ReadX 13702 1140 4096 4096
ReadX 13702 276 4096 4096
ReadX 13702 2020 4096 4096
ReadX 13702 2880 4096 4096
ReadX 13702 516 4096 4096
ReadX 13702 1844 4096 4096
ReadX 13702 1124 4096 4096
ReadX 13702 3136 4096 4096
ReadX 13702 324 4096 4096
ReadX 13702 1156 4096 4096
ReadX 13702 1172 4096 4096
ReadX 13702 2112 4096 4096
ReadX 13702 2368 4096 4096
ReadX 13702 964 4096 4096
ReadX 13702 980 4096 4096
ReadX 13702 1012 4096 4096
ReadX 13702 532 4096 4096
ReadX 13702 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13702 1620 4096 4096
ReadX 13702 1604 4096 4096
ReadX 13702 2116 4096 4096
ReadX 13702 2132 4096 4096
ReadX 13702 2148 4096 4096
ReadX 13702 2276 4096 4096
ReadX 13702 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13719
Close 13719
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13721
QUERY_FILE_INFORMATION 13685
Close 13685
WriteX 13721 4088 1 1
QUERY_FILE_INFORMATION 13721
QUERY_FILE_INFORMATION 13687
Close 13687
WriteX 13721 0 65471 65471
WriteX 13721 65471 65 65
WriteX 13721 65536 64850 64850
Close 13721
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13723
WriteX 13723 15 1 1
QUERY_FILE_INFORMATION 13723
ReadX 13702 2068 4096 4096
ReadX 13702 1588 4096 4096
ReadX 13702 1572 4096 4096
WriteX 13723 0 18630 18630
Flush 13723
Close 13723
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13713
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13724
Close 13724
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13725
ReadX 13725 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13702 612 4096 4096
ReadX 13702 564 4096 4096
ReadX 13702 1876 4096 4096
ReadX 13702 628 4096 4096
ReadX 13702 740 4096 4096
ReadX 13702 724 4096 4096
ReadX 13702 644 4096 4096
ReadX 13702 2324 4096 4096
ReadX 13702 660 4096 4096
ReadX 13702 852 4096 4096
ReadX 13702 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13702 2368 4096 4096
ReadX 13702 1024 4096 4096
ReadX 13702 320 4096 4096
ReadX 13702 580 4096 4096
ReadX 13702 3136 512 512
ReadX 13702 2880 4096 4096
Close 13702
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13726
ReadX 13726 61440 4096 4096
ReadX 13726 126976 4096 4096
WriteX 13726 0 65471 65471
WriteX 13726 65471 65 65
WriteX 13726 65536 65471 65471
WriteX 13726 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13727
ReadX 13727 61440 4096 4096
ReadX 13727 126976 4096 4096
ReadX 13727 192512 4096 4096
ReadX 13727 258048 4096 4096
WriteX 13727 0 65471 65471
WriteX 13727 65471 65 65
WriteX 13727 65536 65471 65471
WriteX 13727 131007 65 65
WriteX 13727 131072 65471 65471
WriteX 13727 196543 65 65
WriteX 13727 196608 65471 65471
WriteX 13727 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13728
ReadX 13728 61440 4096 4096
ReadX 13728 126976 4096 4096
ReadX 13728 192512 4096 4096
ReadX 13728 258048 4096 4096
ReadX 13728 323584 4096 4096
ReadX 13728 389120 4096 4096
ReadX 13728 454656 4096 4096
ReadX 13728 520192 4096 4096
WriteX 13728 0 65471 65471
WriteX 13728 65471 65 65
WriteX 13728 65536 65471 65471
WriteX 13728 131007 65 65
WriteX 13728 131072 65471 65471
WriteX 13728 196543 65 65
WriteX 13728 196608 65471 65471
WriteX 13728 262079 65 65
WriteX 13728 262144 65471 65471
WriteX 13728 327615 65 65
WriteX 13728 327680 65471 65471
WriteX 13728 393151 65 65
WriteX 13728 393216 65471 65471
WriteX 13728 458687 65 65
WriteX 13728 458752 65471 65471
WriteX 13728 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13729
Close 13729
Close 13725
Close 13700
Close 13726
Close 13727
Close 13728
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13730
Close 13730
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13733
Close 13733
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13735
Close 13735
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13736
Close 13736
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13739
Close 13739
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13741
Close 13741
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13742
Close 13742
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13745
Close 13745
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13749
Close 13749
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13753
Close 13753
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13757
Close 13757
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13761
Close 13761
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13765
Close 13765
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13769
Close 13769
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13773
Close 13773
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13775
Close 13775
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13777
Close 13777
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13779
WriteX 13779 4095 1 1
QUERY_FILE_INFORMATION 13779
QUERY_FS_INFORMATION 259
WriteX 13779 0 65471 65471
WriteX 13779 65471 65 65
WriteX 13779 65536 65471 65471
WriteX 13779 131007 65 65
WriteX 13779 131072 65471 65471
WriteX 13779 196543 65 65
WriteX 13779 196608 65471 65471
WriteX 13779 262079 65 65
WriteX 13779 262144 26634 26634
Close 13779
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13784
Close 13784
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13785
Close 13785
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13786
ReadX 13786 0 4096 4096
Close 13786
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13787
ReadX 13787 0 4096 4096
ReadX 13787 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13788
Close 13788
Close 13787
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13791
Close 13791
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13793
Close 13793
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13794
Close 13794
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13797
Close 13797
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13799
Close 13799
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13800
Close 13800
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13803
Close 13803
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13807
Close 13807
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13811
Close 13811
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13815
Close 13815
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13819
Close 13819
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13823
Close 13823
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13826
Close 13826
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13830
Close 13830
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13834
Close 13834
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13836
Close 13836
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13837
Close 13837
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13846
Close 13846
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13847
FIND_FIRST \clients\client1\~dmtmp\*
Close 13847
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13848
Close 13848
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13849
ReadX 13849 0 4096 4096
Close 13849
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13850
ReadX 13850 0 4096 4096
Close 13850
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13851
ReadX 13851 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13861
Close 13861
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13862
FIND_FIRST \clients\client1\~dmtmp\*
Close 13862
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13863
Close 13863
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13864
ReadX 13864 0 4096 4096
Close 13864
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13865
ReadX 13865 0 4096 4096
Close 13865
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13866
ReadX 13866 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13867
ReadX 13867 0 65471 65471
ReadX 13867 65471 65 65
ReadX 13867 65536 65471 65471
ReadX 13867 131007 65 65
ReadX 13867 131072 65471 65471
ReadX 13867 196543 65 65
ReadX 13867 196608 65471 65471
ReadX 13867 262079 65 65
ReadX 13867 262144 65471 65471
ReadX 13867 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13868
ReadX 13868 0 65471 65471
ReadX 13868 65471 65 65
ReadX 13868 65536 65471 65471
ReadX 13868 131007 65 65
ReadX 13868 131072 65471 65471
ReadX 13868 196543 65 65
ReadX 13868 196608 65471 65471
ReadX 13868 262079 65 65
ReadX 13868 262144 65471 65471
ReadX 13868 327615 65 65
ReadX 13868 327680 65471 65471
ReadX 13868 393151 65 65
ReadX 13868 393216 65471 65471
ReadX 13868 458687 65 65
ReadX 13868 458752 65471 65471
ReadX 13868 524223 65 65
ReadX 13868 524288 65471 65471
ReadX 13868 589759 65 65
ReadX 13868 589824 65471 65471
ReadX 13868 655295 65 65
ReadX 13868 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13869
ReadX 13869 0 65471 65471
ReadX 13869 65471 65 65
ReadX 13869 65536 65471 65471
ReadX 13869 131007 65 65
ReadX 13869 131072 65471 65471
ReadX 13869 196543 65 65
ReadX 13869 196608 65471 65471
ReadX 13869 262079 65 65
ReadX 13869 262144 65471 65471
ReadX 13869 327615 65 65
ReadX 13869 327680 65471 65471
ReadX 13869 393151 65 65
ReadX 13869 393216 65471 65471
ReadX 13869 458687 65 65
ReadX 13869 458752 65471 65471
ReadX 13869 524223 65 65
ReadX 13869 524288 65471 65471
ReadX 13869 589759 65 65
ReadX 13869 589824 65471 65471
ReadX 13869 655295 65 65
ReadX 13869 655360 65471 65471
ReadX 13869 720831 65 65
ReadX 13869 720896 65471 65471
ReadX 13869 786367 65 65
ReadX 13869 786432 65471 65471
ReadX 13869 851903 65 65
ReadX 13869 851968 65471 65471
ReadX 13869 917439 65 65
ReadX 13869 917504 65471 65471
ReadX 13869 982975 65 65
ReadX 13869 983040 65471 65471
ReadX 13869 1048511 65 65
ReadX 13869 1048576 65471 65471
ReadX 13869 1114047 65 65
ReadX 13869 1114112 65471 65471
ReadX 13869 1179583 65 65
ReadX 13869 1179648 65471 65471
ReadX 13869 1245119 65 65
ReadX 13869 1245184 65471 65471
ReadX 13869 1310655 65 65
ReadX 13869 1310720 65471 65471
ReadX 13869 1376191 65 65
ReadX 13869 1376256 65471 65471
ReadX 13869 1441727 65 65
ReadX 13869 1441792 65471 65471
ReadX 13869 1507263 65 65
ReadX 13869 1507328 65471 65471
ReadX 13869 1572799 65 65
ReadX 13869 1572864 65471 65471
ReadX 13869 1638335 65 65
ReadX 13869 1638400 65471 65471
ReadX 13869 1703871 65 65
ReadX 13869 1703936 65471 65471
ReadX 13869 1769407 65 65
ReadX 13869 1769472 65471 65471
ReadX 13869 1834943 65 65
ReadX 13869 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13870
ReadX 13870 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13870 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13870 8192 4096 4096
ReadX 13870 12288 4096 4096
ReadX 13870 16384 4096 4096
ReadX 13870 20480 4096 4096
ReadX 13870 24576 4096 4096
ReadX 13870 28672 4096 4096
ReadX 13870 32768 4096 4096
ReadX 13870 36864 4096 4096
ReadX 13870 40960 4096 4096
ReadX 13870 45056 4096 4096
ReadX 13870 49152 4096 4096
ReadX 13870 53248 4096 4096
ReadX 13870 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13870 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13871
Close 13871
Close 13851
Close 13866
Close 13867
Close 13868
Close 13869
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13872
WriteX 13872 1535 1 1
QUERY_FILE_INFORMATION 13872
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13870 0 4096 4096
ReadX 13870 4096 4096 4096
QUERY_FILE_INFORMATION 13872
WriteX 13872 0 57088 57088
WriteX 13872 0 4096 4096
Flush 13872
Close 13870
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13873
Close 13873
WriteX 13872 0 4096 4096
Close 13872
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13874
Close 13874
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13875
ReadX 13875 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13875 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13876
WriteX 13876 1535 1 1
QUERY_FILE_INFORMATION 13876
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13875 0 4096 4096
QUERY_FILE_INFORMATION 13876
WriteX 13876 0 51456 51456
WriteX 13876 0 4096 4096
Flush 13876
Close 13875
WriteX 13876 0 4096 4096
Close 13876
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13877
Close 13877
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13878
ReadX 13878 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13878 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13880
Close 13880
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13882
WriteX 13882 4045 1 1
QUERY_FILE_INFORMATION 13882
WriteX 13882 0 53077 53077
Close 13882
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13883
WriteX 13883 1535 1 1
QUERY_FILE_INFORMATION 13883
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13878 0 4096 4096
QUERY_FILE_INFORMATION 13883
WriteX 13883 0 65471 65471
WriteX 13883 65471 65 65
WriteX 13883 65536 1856 1856
WriteX 13883 0 4096 4096
Flush 13883
Close 13878
WriteX 13883 0 4096 4096
Close 13883
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13884
Close 13884
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13885
ReadX 13885 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13887
Close 13887
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13889
WriteX 13889 4076 1 1
QUERY_FILE_INFORMATION 13889
WriteX 13889 0 7983 7983
Close 13889
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13891
Close 13891
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13893
WriteX 13893 4095 1 1
QUERY_FILE_INFORMATION 13893
WriteX 13893 0 65471 65471
WriteX 13893 65471 65 65
WriteX 13893 65536 65471 65471
WriteX 13893 131007 65 65
WriteX 13893 131072 65471 65471
WriteX 13893 196543 65 65
WriteX 13893 196608 65471 65471
WriteX 13893 262079 65 65
WriteX 13893 262144 65471 65471
WriteX 13893 327615 65 65
WriteX 13893 327680 65471 65471
WriteX 13893 393151 65 65
WriteX 13893 393216 65471 65471
WriteX 13893 458687 65 65
WriteX 13893 458752 46731 46731
Close 13893
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13894
WriteX 13894 1535 1 1
QUERY_FILE_INFORMATION 13894
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 0 4096 4096
ReadX 13885 4096 4096 4096
QUERY_FILE_INFORMATION 13894
WriteX 13894 0 65471 65471
WriteX 13894 65471 65 65
WriteX 13894 65536 22848 22848
WriteX 13894 0 4096 4096
Flush 13894
Close 13885
WriteX 13894 0 4096 4096
Close 13894
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13895
Close 13895
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13896
ReadX 13896 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13896 4096 4096 4096
Close 13896
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13897
ReadX 13897 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13897 0 8192 8192
ReadX 13897 8192 4096 4096
ReadX 13897 12288 4096 4096
ReadX 13897 16384 4096 4096
ReadX 13897 20480 4096 4096
ReadX 13897 24576 4096 4096
ReadX 13897 28672 4096 4096
ReadX 13897 32768 4096 4096
ReadX 13897 36864 4096 4096
ReadX 13897 40960 4096 4096
ReadX 13897 45056 4096 4096
ReadX 13897 49152 4096 4096
ReadX 13897 53248 4096 4096
ReadX 13897 57344 4096 4096
ReadX 13897 61440 4096 4096
ReadX 13897 65536 4096 4096
ReadX 13897 69632 4096 4096
ReadX 13897 73728 4096 4096
ReadX 13897 77824 4096 4096
ReadX 13897 81920 4096 4096
ReadX 13897 86016 4096 4096
ReadX 13897 90112 4096 4096
ReadX 13897 94208 4096 4096
ReadX 13897 98304 4096 4096
ReadX 13897 102400 4096 4096
ReadX 13897 106496 4096 4096
ReadX 13897 110592 4096 4096
ReadX 13897 114688 4096 4096
ReadX 13897 118784 4096 4096
ReadX 13897 122880 4096 4096
ReadX 13897 126976 4096 4096
ReadX 13897 131072 4096 4096
ReadX 13897 135168 4096 4096
ReadX 13897 139264 4096 4096
ReadX 13897 143360 4096 4096
ReadX 13897 147456 4096 4096
ReadX 13897 151552 4096 4096
ReadX 13897 155648 4096 4096
ReadX 13897 159744 4096 4096
ReadX 13897 163840 4096 4096
ReadX 13897 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13897 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13898
Close 13898
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13899
WriteX 13899 2047 1 1
QUERY_FILE_INFORMATION 13899
Close 13897
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13900
Close 13900
WriteX 13899 0 42388 42388
Close 13899
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13901
Close 13901
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13902
ReadX 13902 0 4096 4096
ReadX 13902 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13903
WriteX 13903 2047 1 1
QUERY_FILE_INFORMATION 13903
Close 13902
WriteX 13903 0 42652 42652
Close 13903
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13904
Close 13904
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13905
ReadX 13905 0 4096 4096
ReadX 13905 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13907
Close 13907
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13909
WriteX 13909 4080 1 1
QUERY_FILE_INFORMATION 13909
WriteX 13909 0 65471 65471
WriteX 13909 65471 65 65
WriteX 13909 65536 49 49
Close 13909
Close 13905
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13910
ReadX 13910 61440 4096 4096
ReadX 13910 126976 4096 4096
WriteX 13910 0 65471 65471
WriteX 13910 65471 65 65
WriteX 13910 65536 65471 65471
WriteX 13910 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13911
ReadX 13911 61440 4096 4096
ReadX 13911 126976 4096 4096
ReadX 13911 192512 4096 4096
ReadX 13911 258048 4096 4096
WriteX 13911 0 65471 65471
WriteX 13911 65471 65 65
WriteX 13911 65536 65471 65471
WriteX 13911 131007 65 65
WriteX 13911 131072 65471 65471
WriteX 13911 196543 65 65
WriteX 13911 196608 65471 65471
WriteX 13911 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13912
ReadX 13912 61440 4096 4096
ReadX 13912 126976 4096 4096
ReadX 13912 192512 4096 4096
ReadX 13912 258048 4096 4096
ReadX 13912 323584 4096 4096
ReadX 13912 389120 4096 4096
ReadX 13912 454656 4096 4096
ReadX 13912 520192 4096 4096
WriteX 13912 0 65471 65471
WriteX 13912 65471 65 65
WriteX 13912 65536 65471 65471
WriteX 13912 131007 65 65
WriteX 13912 131072 65471 65471
WriteX 13912 196543 65 65
WriteX 13912 196608 65471 65471
WriteX 13912 262079 65 65
WriteX 13912 262144 65471 65471
WriteX 13912 327615 65 65
WriteX 13912 327680 65471 65471
WriteX 13912 393151 65 65
WriteX 13912 393216 65471 65471
WriteX 13912 458687 65 65
WriteX 13912 458752 65471 65471
WriteX 13912 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13913
FIND_FIRST \clients\client1\~dmtmp\*
Close 13913
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13914
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13914 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13915
ReadX 13915 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13916
ReadX 13916 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13917
ReadX 13917 0 4096 4096
ReadX 13914 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13914
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13918
ReadX 13918 0 4096 4096
ReadX 13918 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13919
FIND_FIRST \clients\client1\~dmtmp\*
Close 13919
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13920
QUERY_FILE_INFORMATION 13920
WriteX 13920 2047 1 1
QUERY_FILE_INFORMATION 13920
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13921
Close 13921
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13922
WriteX 13922 52 1 1
QUERY_FILE_INFORMATION 13922
WriteX 13922 0 491 491
Close 13922
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13923
ReadX 13923 0 491 491
WriteX 13920 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13918
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13924
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13924 0 4096 4096
ReadX 13924 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13926
Close 13926
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13927
WriteX 13927 52 1 1
QUERY_FILE_INFORMATION 13927
WriteX 13927 0 543 543
Close 13927
Close 13924
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13928
ReadX 13928 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13929
ReadX 13929 0 543 543
ReadX 13928 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13928
Close 13923
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13910
Close 13911
Close 13912
Close 13929
Close 13915
Close 13916
Close 13917
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13920
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13930
FIND_FIRST \clients\client1\~dmtmp\*
Close 13930
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13931
ReadX 13931 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13932
ReadX 13932 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13933
ReadX 13933 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13934
ReadX 13934 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13935
ReadX 13935 0 543 543
ReadX 13931 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13939
FIND_FIRST \clients\client1\~dmtmp\*
Close 13939
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13940
QUERY_FILE_INFORMATION 13940
WriteX 13940 2047 1 1
QUERY_FILE_INFORMATION 13940
WriteX 13940 0 2048 2048
Close 13940
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13941
ReadX 13941 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13941
Close 13931
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13942
ReadX 13942 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13942 4095 1 1
QUERY_FILE_INFORMATION 13942
ReadX 13942 0 4096 4096
WriteX 13942 0 4096 4096
Flush 13942
WriteX 13942 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13943
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13943 0 4096 4096
ReadX 13943 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13947
FIND_FIRST \clients\client1\~dmtmp\*
Close 13947
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13948
WriteX 13948 2047 1 1
QUERY_FILE_INFORMATION 13948
WriteX 13948 0 2048 2048
Close 13948
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13949
ReadX 13949 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13953
Close 13953
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13954
WriteX 13954 2047 1 1
QUERY_FILE_INFORMATION 13954
WriteX 13954 0 2048 2048
Close 13954
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13955
ReadX 13955 0 2048 2048
ReadX 13943 4096 16384 16384
Close 13955
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13956
ReadX 13956 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13956
Close 13935
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13949 4095 1 1
QUERY_FILE_INFORMATION 13949
ReadX 13949 0 4096 4096
WriteX 13949 0 4096 4096
Close 13949
WriteX 13943 0 8192 8192
Close 13943
WriteX 13932 0 4096 4096
WriteX 13933 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13958
ReadX 13958 0 4096 4096
ReadX 13958 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13958
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13959
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13959 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13960
ReadX 13960 0 543 543
ReadX 13959 0 4096 4096
Close 13959
Close 13942
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13961
QUERY_FILE_INFORMATION 13961
Close 13961
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13960
Close 13932
Close 13933
Close 13934
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13962
FIND_FIRST \clients\client1\~dmtmp\*
Close 13962
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13963
ReadX 13963 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13964
ReadX 13964 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13965
ReadX 13965 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13966
ReadX 13966 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13967
ReadX 13967 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13968
ReadX 13968 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13969
ReadX 13969 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13970
ReadX 13970 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13971
ReadX 13971 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13972
ReadX 13972 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13973
ReadX 13973 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13974
ReadX 13974 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13975
ReadX 13975 0 4096 4096
ReadX 13963 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13979
FIND_FIRST \clients\client1\~dmtmp\*
Close 13979
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13980
QUERY_FILE_INFORMATION 13980
WriteX 13980 2047 1 1
QUERY_FILE_INFORMATION 13980
WriteX 13980 0 2048 2048
Close 13980
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13981
ReadX 13981 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13981
Close 13971
Close 13963
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13982
ReadX 13982 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13983
FIND_FIRST \clients\client1\~dmtmp\*
Close 13983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13984
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13984 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13985
ReadX 13985 0 4096 4096
ReadX 13984 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13989
FIND_FIRST \clients\client1\~dmtmp\*
Close 13989
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13990
QUERY_FILE_INFORMATION 13990
WriteX 13990 2047 1 1
QUERY_FILE_INFORMATION 13990
WriteX 13990 0 2048 2048
Close 13990
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13991
ReadX 13991 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13991
Close 13984
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13992
ReadX 13992 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13982 4095 1 1
QUERY_FILE_INFORMATION 13982
ReadX 13982 0 4096 4096
WriteX 13982 0 4096 4096
Flush 13982
WriteX 13992 4095 1 1
QUERY_FILE_INFORMATION 13992
ReadX 13992 0 4096 4096
WriteX 13992 0 4096 4096
Flush 13992
WriteX 13982 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 13992 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13993
ReadX 13993 0 4096 4096
ReadX 13985 0 4096 4096
ReadX 13993 0 4096 4096
ReadX 13993 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13994
FIND_FIRST \clients\client1\~dmtmp\*
Close 13994
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13995
WriteX 13995 4095 1 1
QUERY_FILE_INFORMATION 13995
WriteX 13995 0 4096 4096
Close 13995
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13996
ReadX 13996 0 4096 4096
Close 13993
Close 13985
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13997
Close 13997
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13998
WriteX 13998 4095 1 1
QUERY_FILE_INFORMATION 13998
WriteX 13998 0 4096 4096
Close 13998
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13999
ReadX 13999 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 13999 0 4096 4096
Close 13996
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13975
Close 13969
Close 13972
Close 13973
Close 13974
Close 13970
Close 13964
Close 13967
Close 13968
Close 13965
Close 13966
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13999
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 14001
Close 14001
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 14002
ReadX 14002 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 14003
Close 14003
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14004
WriteX 14004 2047 1 1
QUERY_FILE_INFORMATION 14004
WriteX 14004 0 2048 2048
Close 14004
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14005
ReadX 14005 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14005
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14006
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14006 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14007
ReadX 14007 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14008
ReadX 14008 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14009
ReadX 14009 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14010
ReadX 14010 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14011
ReadX 14011 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14012
ReadX 14012 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14013
ReadX 14013 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 14014
ReadX 14014 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 14015
ReadX 14015 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 14016
ReadX 14016 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 14017
ReadX 14017 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 14018
ReadX 14018 0 4096 4096
ReadX 14006 0 4096 4096
ReadX 14013 0 4096 4096
Close 14013
Close 14006
Close 13982
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 14019
QUERY_FILE_INFORMATION 14019
Close 14019
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 14002
Close 14017
Close 14012
Close 14014
Close 14015
Close 14016
Close 14018
Close 14007
Close 14010
Close 14011
Close 14008
Close 14009
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13992
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 14020
QUERY_FILE_INFORMATION 14020
Close 14020
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14021
FIND_FIRST \clients\client1\~dmtmp\*
Close 14021
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14022
ReadX 14022 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 14023
ReadX 14023 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 14024
ReadX 14024 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 14025
ReadX 14025 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 14026
ReadX 14026 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14027
ReadX 14027 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14028
ReadX 14028 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14029
ReadX 14029 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14030
ReadX 14030 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14031
ReadX 14031 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14032
ReadX 14032 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 14033
ReadX 14033 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14034
ReadX 14034 0 4096 4096
ReadX 14022 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 14038
FIND_FIRST \clients\client1\~dmtmp\*
Close 14038
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 14039
QUERY_FILE_INFORMATION 14039
WriteX 14039 2047 1 1
QUERY_FILE_INFORMATION 14039
WriteX 14039 0 2048 2048
Close 14039
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 14040
ReadX 14040 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 14040
Close 14022
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 14041
ReadX 14041 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14042
FIND_FIRST \clients\client1\~dmtmp\*
Close 14042
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14043
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14043 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14044
ReadX 14044 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14045
ReadX 14045 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14046
ReadX 14046 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14047
ReadX 14047 0 543 543
ReadX 14043 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 14051
FIND_FIRST \clients\client1\~dmtmp\*
Close 14051
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 14052
QUERY_FILE_INFORMATION 14052
WriteX 14052 2047 1 1
QUERY_FILE_INFORMATION 14052
WriteX 14052 0 2048 2048
Close 14052
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 14053
ReadX 14053 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 14053
Close 14043
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 14054
ReadX 14054 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 14027
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14055
FIND_FIRST \clients\client1\~dmtmp\*
Close 14055
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14056
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14056 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14057
ReadX 14057 0 4096 4096
ReadX 14056 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 14061
FIND_FIRST \clients\client1\~dmtmp\*
Close 14061
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 14062
QUERY_FILE_INFORMATION 14062
WriteX 14062 2047 1 1
QUERY_FILE_INFORMATION 14062
WriteX 14062 0 2048 2048
Close 14062
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 14063
ReadX 14063 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 14063
Close 14057
Close 14056
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 14064
ReadX 14064 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 14041 4095 1 1
QUERY_FILE_INFORMATION 14041
ReadX 14041 0 4096 4096
WriteX 14041 0 4096 4096
Flush 14041
WriteX 14054 4095 1 1
QUERY_FILE_INFORMATION 14054
ReadX 14054 0 4096 4096
WriteX 14054 0 4096 4096
Flush 14054
WriteX 14064 4095 1 1
QUERY_FILE_INFORMATION 14064
ReadX 14064 0 4096 4096
WriteX 14064 0 4096 4096
Flush 14064
WriteX 14041 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 14054 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 14064 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14065
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14065 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14066
ReadX 14066 0 4096 4096
ReadX 14065 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14067
ReadX 14067 0 4096 4096
ReadX 14067 0 4096 4096
ReadX 14067 4096 16384 16384
ReadX 14065 4096 16384 16384
ReadX 14065 0 4096 4096
ReadX 14066 0 4096 4096
ReadX 14066 4096 4096 4096
Close 14067
Close 14066
Close 14065
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14068
FIND_FIRST \clients\client1\~dmtmp\*
Close 14068
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14069
ReadX 14069 0 2048 2048
WriteX 14069 18431 1 1
QUERY_FILE_INFORMATION 14069
WriteX 14069 0 19584 19584
Close 14069
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 14070
ReadX 14070 0 4096 4096
ReadX 14070 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14070
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14071
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14071 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14072
ReadX 14072 0 4096 4096
ReadX 14071 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14073
ReadX 14073 0 4096 4096
ReadX 14073 0 4096 4096
Close 14073
Close 14072
Close 14071
Close 14041
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 14074
QUERY_FILE_INFORMATION 14074
Close 14074
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 14047
Close 14034
Close 14026
Close 14044
Close 14045
Close 14046
Close 14033
Close 14028
Close 14031
Close 14032
Close 14029
Close 14030
Close 14023
Close 14024
Close 14025
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 14054
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 14075
QUERY_FILE_INFORMATION 14075
Close 14075
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 14064
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 14076
QUERY_FILE_INFORMATION 14076
Close 14076
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14077
FIND_FIRST \clients\client1\~dmtmp\*
Close 14077
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14078
ReadX 14078 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14079
ReadX 14079 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14080
ReadX 14080 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14081
ReadX 14081 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14082
ReadX 14082 0 543 543
ReadX 14078 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 14078 4096 16384 16384
WriteX 14078 0 4096 4096
Close 14078
WriteX 14079 0 4096 4096
WriteX 14080 0 4096 4096
WriteX 14081 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14083
FIND_FIRST \clients\client1\~dmtmp\*
Close 14083
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14084
ReadX 14084 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14085
ReadX 14085 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14086
ReadX 14086 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14087
ReadX 14087 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14088
ReadX 14088 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14089
ReadX 14089 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14090
ReadX 14090 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14091
ReadX 14091 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 14092
ReadX 14092 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 14093
ReadX 14093 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 14094
ReadX 14094 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 14095
ReadX 14095 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13656
ReadX 13656 0 4096 4096
ReadX 14084 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13657
ReadX 13657 0 8192 8192
ReadX 14084 4096 16384 16384
Close 14091
Close 14084
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13658
FIND_FIRST \clients\client1\~dmtmp\*
Close 13658
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13659
ReadX 13659 0 4096 4096
ReadX 13659 4096 4096 4096
ReadX 13659 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13660
ReadX 13660 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13661
ReadX 13661 0 4096 4096
ReadX 13660 0 4096 4096
ReadX 13660 0 4096 4096
ReadX 13660 4096 16384 16384
Close 13661
WriteX 13660 0 4096 4096
Close 13660
WriteX 14085 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13662
FIND_FIRST \clients\client1\~dmtmp\*
Close 13662
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13663
ReadX 13663 0 4096 4096
ReadX 13663 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13664
ReadX 13664 0 4096 4096
ReadX 13664 0 4096 4096
WriteX 13664 0 4096 4096
Close 13664
WriteX 14079 0 4096 4096
WriteX 14080 0 4096 4096
WriteX 14081 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13665
ReadX 13665 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13666
ReadX 13666 0 4096 4096
ReadX 13665 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13670
FIND_FIRST \clients\client1\~dmtmp\*
Close 13670
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13671
QUERY_FILE_INFORMATION 13671
WriteX 13671 2047 1 1
QUERY_FILE_INFORMATION 13671
WriteX 13671 0 2048 2048
Close 13671
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13672
ReadX 13672 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13672 4095 1 1
QUERY_FILE_INFORMATION 13672
ReadX 13672 0 4096 4096
WriteX 13672 0 4096 4096
Close 13672
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13673
ReadX 13673 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13673 0 4096 4096
Close 13666
Close 13665
WriteX 13673 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13674
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13674 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13675
ReadX 13675 0 4096 4096
ReadX 13674 0 4096 4096
ReadX 13674 4096 16384 16384
Close 13675
Close 13674
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13676
FIND_FIRST \clients\client1\~dmtmp\*
Close 13676
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13677
ReadX 13677 0 4096 4096
ReadX 13677 4096 4096 4096
WriteX 13677 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13677 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13677
ReadX 13673 0 4096 4096
WriteX 13673 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13678
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13678 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13679
ReadX 13679 0 4096 4096
ReadX 13678 0 4096 4096
ReadX 13678 4096 16384 16384
Close 13679
Close 13678
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13680
FIND_FIRST \clients\client1\~dmtmp\*
Close 13680
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13681
ReadX 13681 0 4096 4096
ReadX 13681 4096 4096 4096
WriteX 13681 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13681 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13681
Close 13673
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13682
QUERY_FILE_INFORMATION 13682
Close 13682
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13657
Close 13659
Close 13663
Close 14082
Close 14079
Close 14080
Close 14081
Close 14090
Close 14095
Close 14092
Close 14093
Close 14094
Close 13656
Close 14085
Close 14088
Close 14089
Close 14086
Close 14087
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13683
FIND_FIRST \clients\client1\~dmtmp\*
Close 13683
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13684
ReadX 13684 0 4096 4096
ReadX 13684 4096 4096 4096
ReadX 13684 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13685
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13685 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13686
ReadX 13686 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13687
ReadX 13687 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13688
ReadX 13688 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13689
ReadX 13689 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13690
ReadX 13690 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13691
ReadX 13691 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13692
ReadX 13692 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13693
ReadX 13693 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13694
ReadX 13694 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13695
ReadX 13695 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13696
ReadX 13696 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13697
ReadX 13697 0 4096 4096
ReadX 13685 0 4096 4096
ReadX 13685 0 4096 4096
ReadX 13685 4096 16384 16384
Close 13692
Close 13685
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13698
ReadX 13698 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13699
ReadX 13699 0 4096 4096
ReadX 13698 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13703
FIND_FIRST \clients\client1\~dmtmp\*
Close 13703
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13704
QUERY_FILE_INFORMATION 13704
WriteX 13704 2047 1 1
QUERY_FILE_INFORMATION 13704
WriteX 13704 0 2048 2048
Close 13704
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13705
ReadX 13705 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13705 4095 1 1
QUERY_FILE_INFORMATION 13705
ReadX 13705 0 4096 4096
WriteX 13705 0 4096 4096
Close 13705
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13706
ReadX 13706 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13706 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13710
Close 13710
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13711
QUERY_FILE_INFORMATION 13711
WriteX 13711 2047 1 1
QUERY_FILE_INFORMATION 13711
WriteX 13711 0 2048 2048
Close 13711
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13712
ReadX 13712 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13712 4095 1 1
QUERY_FILE_INFORMATION 13712
ReadX 13712 0 4096 4096
WriteX 13712 0 4096 4096
Close 13712
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13713
ReadX 13713 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13713 0 4096 4096
Close 13698
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13714
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13714 0 4096 4096
ReadX 13714 0 4096 4096
ReadX 13714 4096 16384 16384
Close 13714
Close 13706
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13715
QUERY_FILE_INFORMATION 13715
Close 13715
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13684
Close 13696
Close 13691
Close 13697
Close 13699
Close 13686
Close 13689
Close 13690
Close 13687
Close 13688
Close 13693
Close 13694
Close 13695
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13713
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13716
QUERY_FILE_INFORMATION 13716
Close 13716
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13717
ReadX 13717 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13718
Close 13718
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13719
WriteX 13719 63 1 1
QUERY_FILE_INFORMATION 13719
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13717 0 4096 4096
ReadX 13717 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13717 0 8192 8192
Flush 13717
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13717 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13717 0 8192 8192
Flush 13717
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13717 0 8192 8192
Flush 13717
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13717 0 8192 8192
Flush 13717
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13721
Close 13721
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13723
WriteX 13723 4065 1 1
QUERY_FILE_INFORMATION 13723
WriteX 13723 0 62591 62591
Close 13723
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13725
Close 13725
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13727
WriteX 13727 4094 1 1
QUERY_FILE_INFORMATION 13727
WriteX 13727 0 10845 10845
Close 13727
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13729
Close 13729
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13731
WriteX 13731 4081 1 1
QUERY_FILE_INFORMATION 13731
WriteX 13731 0 30118 30118
Close 13731
WriteX 13717 0 4096 4096
Close 13717
WriteX 13719 0 64 64
Close 13719
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13732
ReadX 13732 61440 4096 4096
ReadX 13732 126976 4096 4096
WriteX 13732 0 65471 65471
WriteX 13732 65471 65 65
WriteX 13732 65536 65471 65471
WriteX 13732 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13733
ReadX 13733 61440 4096 4096
ReadX 13733 126976 4096 4096
ReadX 13733 192512 4096 4096
ReadX 13733 258048 4096 4096
WriteX 13733 0 65471 65471
WriteX 13733 65471 65 65
WriteX 13733 65536 65471 65471
WriteX 13733 131007 65 65
WriteX 13733 131072 65471 65471
WriteX 13733 196543 65 65
WriteX 13733 196608 65471 65471
WriteX 13733 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13734
ReadX 13734 61440 4096 4096
ReadX 13734 126976 4096 4096
ReadX 13734 192512 4096 4096
ReadX 13734 258048 4096 4096
ReadX 13734 323584 4096 4096
ReadX 13734 389120 4096 4096
ReadX 13734 454656 4096 4096
ReadX 13734 520192 4096 4096
WriteX 13734 0 65471 65471
WriteX 13734 65471 65 65
WriteX 13734 65536 65471 65471
WriteX 13734 131007 65 65
WriteX 13734 131072 65471 65471
WriteX 13734 196543 65 65
WriteX 13734 196608 65471 65471
WriteX 13734 262079 65 65
WriteX 13734 262144 65471 65471
WriteX 13734 327615 65 65
WriteX 13734 327680 65471 65471
WriteX 13734 393151 65 65
WriteX 13734 393216 65471 65471
WriteX 13734 458687 65 65
WriteX 13734 458752 65471 65471
WriteX 13734 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13735
Close 13735
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13732
Close 13733
Close 13734
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13736
ReadX 13736 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13737
ReadX 13737 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13738
ReadX 13738 0 4096 4096
ReadX 13738 4096 4096 4096
ReadX 13738 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13739
Close 13739
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13736
Close 13737
Close 13738
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13740
Close 13740
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13741
ReadX 13741 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13742
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13742
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13743
Close 13743
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13744
ReadX 13744 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13745
Close 13745
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13741
Close 13744
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13746
Close 13746
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13747
ReadX 13747 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13748
ReadX 13748 0 8192 8192
ReadX 13748 8192 8192 8192
ReadX 13748 16384 8192 8192
ReadX 13748 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13750
Close 13750
Close 13747
Close 13748
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13752
WriteX 13752 8191 1 1
QUERY_FILE_INFORMATION 13752
WriteX 13752 0 10438 10438
Close 13752
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13753
Close 13753
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13754
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13755
Close 13755
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13756
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13757
Close 13757
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13758
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13759
FIND_FIRST \clients\client1\~dmtmp\*
Close 13759
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13760
Close 13760
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13761
ReadX 13761 0 4096 4096
Close 13761
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13762
ReadX 13762 0 8192 8192
Close 13762
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13763
ReadX 13763 0 8192 8192
ReadX 13763 8192 4096 4096
ReadX 13763 12288 8192 8192
ReadX 13763 20480 8192 8192
ReadX 13763 28672 8192 8192
ReadX 13763 36864 8192 8192
ReadX 13763 45056 8192 8192
ReadX 13763 53248 8192 8192
ReadX 13763 61440 8192 8192
ReadX 13763 69632 8192 8192
ReadX 13763 77824 8192 8192
ReadX 13763 86016 8192 8192
ReadX 13763 94208 8192 8192
ReadX 13763 102400 8192 8192
ReadX 13763 110592 8192 8192
ReadX 13763 118784 8192 8192
ReadX 13763 126976 8192 8192
ReadX 13763 135168 8192 8192
ReadX 13763 143360 8192 8192
ReadX 13763 151552 8192 8192
ReadX 13763 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13764
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13764
Close 13763
Close 13754
Close 13756
Close 13758
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13765
Close 13765
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13767
WriteX 13767 8191 1 1
QUERY_FILE_INFORMATION 13767
WriteX 13767 0 28489 28489
Close 13767
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13768
Close 13768
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13769
FIND_FIRST \clients\client1\~dmtmp\*
Close 13769
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13770
Close 13770
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13771
ReadX 13771 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13772
Close 13772
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13771
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13773
Close 13773
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13774
ReadX 13774 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13775
ReadX 13775 0 8192 8192
ReadX 13775 8192 8192 8192
ReadX 13775 16384 8192 8192
ReadX 13775 24576 8192 8192
ReadX 13775 32768 16384 16384
ReadX 13775 49152 8192 8192
ReadX 13775 57344 8192 8192
ReadX 13775 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13777
Close 13777
Close 13774
Close 13775
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13779
WriteX 13779 8191 1 1
QUERY_FILE_INFORMATION 13779
WriteX 13779 0 29253 29253
Close 13779
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13780
Close 13780
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13781
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13782
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13782
Close 13781
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13783
Close 13783
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13785
WriteX 13785 8191 1 1
QUERY_FILE_INFORMATION 13785
WriteX 13785 0 30183 30183
Close 13785
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13786
Close 13786
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13787
WriteX 13787 0 510 510
WriteX 13787 510 512 512
WriteX 13787 1022 510 510
WriteX 13787 1532 510 510
WriteX 13787 2042 168 168
Close 13787
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13788
Close 13788
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13789
ReadX 13789 0 4096 4096
WriteX 13789 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13790
ReadX 13790 0 65471 65471
ReadX 13790 65471 65 65
ReadX 13790 65536 65471 65471
ReadX 13790 131007 65 65
ReadX 13790 131072 65471 65471
ReadX 13790 196543 65 65
ReadX 13790 196608 65471 65471
ReadX 13790 262079 65 65
ReadX 13790 262144 65471 65471
ReadX 13790 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13791
ReadX 13791 0 65471 65471
ReadX 13791 65471 65 65
ReadX 13791 65536 65471 65471
ReadX 13791 131007 65 65
ReadX 13791 131072 65471 65471
ReadX 13791 196543 65 65
ReadX 13791 196608 65471 65471
ReadX 13791 262079 65 65
ReadX 13791 262144 65471 65471
ReadX 13791 327615 65 65
ReadX 13791 327680 65471 65471
ReadX 13791 393151 65 65
ReadX 13791 393216 65471 65471
ReadX 13791 458687 65 65
ReadX 13791 458752 65471 65471
ReadX 13791 524223 65 65
ReadX 13791 524288 65471 65471
ReadX 13791 589759 65 65
ReadX 13791 589824 65471 65471
ReadX 13791 655295 65 65
ReadX 13791 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13792
ReadX 13792 0 65471 65471
ReadX 13792 65471 65 65
ReadX 13792 65536 65471 65471
ReadX 13792 131007 65 65
ReadX 13792 131072 65471 65471
ReadX 13792 196543 65 65
ReadX 13792 196608 65471 65471
ReadX 13792 262079 65 65
ReadX 13792 262144 65471 65471
ReadX 13792 327615 65 65
ReadX 13792 327680 65471 65471
ReadX 13792 393151 65 65
ReadX 13792 393216 65471 65471
ReadX 13792 458687 65 65
ReadX 13792 458752 65471 65471
ReadX 13792 524223 65 65
ReadX 13792 524288 65471 65471
ReadX 13792 589759 65 65
ReadX 13792 589824 65471 65471
ReadX 13792 655295 65 65
ReadX 13792 655360 65471 65471
ReadX 13792 720831 65 65
ReadX 13792 720896 65471 65471
ReadX 13792 786367 65 65
ReadX 13792 786432 65471 65471
ReadX 13792 851903 65 65
ReadX 13792 851968 65471 65471
ReadX 13792 917439 65 65
ReadX 13792 917504 65471 65471
ReadX 13792 982975 65 65
ReadX 13792 983040 65471 65471
ReadX 13792 1048511 65 65
ReadX 13792 1048576 65471 65471
ReadX 13792 1114047 65 65
ReadX 13792 1114112 65471 65471
ReadX 13792 1179583 65 65
ReadX 13792 1179648 65471 65471
ReadX 13792 1245119 65 65
ReadX 13792 1245184 65471 65471
ReadX 13792 1310655 65 65
ReadX 13792 1310720 65471 65471
ReadX 13792 1376191 65 65
ReadX 13792 1376256 65471 65471
ReadX 13792 1441727 65 65
ReadX 13792 1441792 65471 65471
ReadX 13792 1507263 65 65
ReadX 13792 1507328 65471 65471
ReadX 13792 1572799 65 65
ReadX 13792 1572864 65471 65471
ReadX 13792 1638335 65 65
ReadX 13792 1638400 65471 65471
ReadX 13792 1703871 65 65
ReadX 13792 1703936 65471 65471
ReadX 13792 1769407 65 65
ReadX 13792 1769472 65471 65471
ReadX 13792 1834943 65 65
ReadX 13792 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13793
ReadX 13793 0 4096 4096
ReadX 13793 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13794
WriteX 13794 52 1 1
QUERY_FILE_INFORMATION 13794
WriteX 13794 0 53 53
Close 13794
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13795
Close 13795
Close 13789
Close 13790
Close 13791
Close 13792
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13793 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13796
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13793 0 4096 4096
ReadX 13793 4096 4096 4096
ReadX 13793 8192 4096 4096
ReadX 13793 12288 4096 4096
WriteX 13796 15359 1 1
QUERY_FILE_INFORMATION 13796
ReadX 13793 16384 4096 4096
ReadX 13793 20480 4096 4096
WriteX 13796 0 15360 15360
Close 13796
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13797
ReadX 13797 0 4096 4096
WriteX 13797 0 4096 4096
Close 13797
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13798
Close 13798
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13799
ReadX 13799 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13800
Close 13800
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13793
ReadX 13799 0 4096 4096
ReadX 13799 4096 4096 4096
ReadX 13799 8192 4096 4096
ReadX 13799 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13801
ReadX 13801 0 4096 4096
ReadX 13801 0 4096 4096
ReadX 13801 4096 4096 4096
ReadX 13801 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13802
ReadX 13802 0 4096 4096
ReadX 13802 4096 4096 4096
ReadX 13802 8192 4096 4096
Close 13801
Close 13802
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13803
WriteX 13803 15359 1 1
QUERY_FILE_INFORMATION 13803
WriteX 13803 0 15360 15360
Close 13803
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13804
ReadX 13804 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13799
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13805
Close 13805
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13806
ReadX 13806 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13807
Close 13807
WriteX 13804 0 4096 4096
Close 13804
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13808
Close 13808
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13809
ReadX 13809 0 4096 4096
ReadX 13809 0 4096 4096
ReadX 13809 4096 4096 4096
ReadX 13809 8192 4096 4096
ReadX 13809 12288 3072 3072
ReadX 13809 0 8192 8192
ReadX 13809 8192 4096 4096
ReadX 13809 12288 3072 3072
WriteX 13809 15469 1 1
QUERY_FILE_INFORMATION 13809
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13810
ReadX 13810 0 4096 4096
ReadX 13810 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13811
WriteX 13811 52 1 1
QUERY_FILE_INFORMATION 13811
WriteX 13811 0 53 53
Close 13811
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13809 0 19054 19054
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13812
Close 13812
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13813
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13810 0 8192 8192
ReadX 13810 8192 4096 4096
ReadX 13810 12288 4096 4096
WriteX 13813 12005 1 1
QUERY_FILE_INFORMATION 13813
WriteX 13813 0 12006 12006
Close 13813
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13814
ReadX 13814 0 4096 4096
WriteX 13814 0 4096 4096
Close 13814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13815
Close 13815
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13816
ReadX 13816 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13817
Close 13817
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13810
ReadX 13816 0 4096 4096
ReadX 13816 4096 4096 4096
ReadX 13816 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13818
WriteX 13818 11990 1 1
QUERY_FILE_INFORMATION 13818
WriteX 13818 0 11991 11991
Close 13818
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13819
ReadX 13819 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13816
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13820
Close 13820
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13821
ReadX 13821 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13822
Close 13822
WriteX 13819 0 4096 4096
Close 13819
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13823
Close 13823
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13824
ReadX 13824 0 4096 4096
ReadX 13824 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13825
Close 13825
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13824 0 8192 8192
ReadX 13824 8192 3799 3799
WriteX 13824 13247 1 1
QUERY_FILE_INFORMATION 13824
WriteX 13824 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13824 0 8192 8192
ReadX 13824 8192 4096 4096
Close 13806
Close 13809
WriteX 13824 0 12288 12288
Close 13824
Close 13821
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13826
Close 13826
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13827
Close 13827
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13828
ReadX 13828 61440 4096 4096
ReadX 13828 126976 4096 4096
WriteX 13828 0 65471 65471
WriteX 13828 65471 65 65
WriteX 13828 65536 65471 65471
WriteX 13828 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13829
ReadX 13829 61440 4096 4096
ReadX 13829 126976 4096 4096
ReadX 13829 192512 4096 4096
ReadX 13829 258048 4096 4096
WriteX 13829 0 65471 65471
WriteX 13829 65471 65 65
WriteX 13829 65536 65471 65471
WriteX 13829 131007 65 65
WriteX 13829 131072 65471 65471
WriteX 13829 196543 65 65
WriteX 13829 196608 65471 65471
WriteX 13829 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13830
ReadX 13830 61440 4096 4096
ReadX 13830 126976 4096 4096
ReadX 13830 192512 4096 4096
ReadX 13830 258048 4096 4096
ReadX 13830 323584 4096 4096
ReadX 13830 389120 4096 4096
ReadX 13830 454656 4096 4096
ReadX 13830 520192 4096 4096
WriteX 13830 0 65471 65471
WriteX 13830 65471 65 65
WriteX 13830 65536 65471 65471
WriteX 13830 131007 65 65
WriteX 13830 131072 65471 65471
WriteX 13830 196543 65 65
WriteX 13830 196608 65471 65471
WriteX 13830 262079 65 65
WriteX 13830 262144 65471 65471
WriteX 13830 327615 65 65
WriteX 13830 327680 65471 65471
WriteX 13830 393151 65 65
WriteX 13830 393216 65471 65471
WriteX 13830 458687 65 65
WriteX 13830 458752 65471 65471
WriteX 13830 524223 65 65
Close 13828
Close 13829
Close 13830
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13831
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13831 0 4096 4096
Close 13831
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13832
ReadX 13832 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13832
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13833
ReadX 13833 0 4096 4096
ReadX 13833 4096 4096 4096
ReadX 13833 8192 4096 4096
ReadX 13833 12288 4096 4096
ReadX 13833 16384 4096 4096
ReadX 13833 20480 4096 4096
ReadX 13833 24576 4096 4096
ReadX 13833 28672 4096 4096
ReadX 13833 32768 4096 4096
ReadX 13833 36864 4096 4096
ReadX 13833 40960 4096 4096
ReadX 13833 45056 4096 4096
ReadX 13833 49152 4096 4096
ReadX 13833 53248 4096 4096
ReadX 13833 57344 4096 4096
ReadX 13833 61440 4096 4096
ReadX 13833 65536 4096 4096
ReadX 13833 69632 4096 4096
ReadX 13833 73728 4096 4096
WriteX 13833 0 4096 4096
Close 13833
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13834
Close 13834
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13835
ReadX 13835 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13836
Close 13836
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13835
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13838
WriteX 13838 4607 1 1
QUERY_FILE_INFORMATION 13838
WriteX 13838 0 65471 65471
WriteX 13838 65471 65 65
WriteX 13838 65536 19979 19979
Close 13838
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13839
ReadX 13839 0 4096 4096
WriteX 13839 0 4096 4096
Flush 13839
WriteX 13839 0 4096 4096
Flush 13839
QUERY_FILE_INFORMATION 13839
WriteX 13839 0 4096 4096
Flush 13839
WriteX 13839 0 4096 4096
Flush 13839
WriteX 13839 0 4096 4096
Flush 13839
WriteX 13839 0 4096 4096
Flush 13839
Close 13839
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13840
ReadX 13840 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13841
ReadX 13841 0 4096 4096
Close 13840
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13842
ReadX 13842 0 4096 4096
Close 13842
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13843
ReadX 13843 0 4096 4096
Close 13843
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13844
ReadX 13844 0 4096 4096
WriteX 13844 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13845
Close 13845
Close 13841
Close 13844
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13846
Close 13846
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13848
WriteX 13848 4607 1 1
QUERY_FILE_INFORMATION 13848
WriteX 13848 0 65471 65471
WriteX 13848 65471 65 65
WriteX 13848 65536 17654 17654
Close 13848
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13849
ReadX 13849 0 4096 4096
WriteX 13849 0 4096 4096
Flush 13849
WriteX 13849 0 4096 4096
Flush 13849
QUERY_FILE_INFORMATION 13849
WriteX 13849 0 4096 4096
Flush 13849
WriteX 13849 0 4096 4096
Flush 13849
WriteX 13849 0 4096 4096
Flush 13849
WriteX 13849 0 4096 4096
Flush 13849
Close 13849
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13850
Close 13850
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13851
ReadX 13851 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13852
Close 13852
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13853
ReadX 13853 0 4096 4096
ReadX 13853 4096 4096 4096
ReadX 13853 8192 4096 4096
ReadX 13853 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13853 16384 4096 4096
ReadX 13853 20480 4096 4096
ReadX 13853 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13851
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13854
ReadX 13854 0 4096 4096
Close 13854
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13855
ReadX 13855 0 4096 4096
Close 13855
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13856
ReadX 13856 0 4096 4096
WriteX 13856 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13857
Close 13857
Close 13856
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13858
Close 13858
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13860
WriteX 13860 4607 1 1
QUERY_FILE_INFORMATION 13860
WriteX 13860 0 65471 65471
WriteX 13860 65471 65 65
WriteX 13860 65536 19490 19490
Close 13860
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13861
ReadX 13861 0 4096 4096
WriteX 13861 0 4096 4096
Flush 13861
WriteX 13861 0 4096 4096
Flush 13861
QUERY_FILE_INFORMATION 13861
WriteX 13861 0 4096 4096
Flush 13861
WriteX 13861 0 4096 4096
Flush 13861
WriteX 13861 0 4096 4096
Flush 13861
WriteX 13861 0 4096 4096
Flush 13861
Close 13861
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13862
Close 13862
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13863
ReadX 13863 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13864
Close 13864
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13863
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13865
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13865 0 4096 4096
Close 13865
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13866
ReadX 13866 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13866
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13867
ReadX 13867 0 4096 4096
ReadX 13867 4096 4096 4096
ReadX 13867 8192 4096 4096
ReadX 13867 12288 4096 4096
ReadX 13867 16384 4096 4096
ReadX 13867 20480 4096 4096
ReadX 13867 24576 4096 4096
ReadX 13867 28672 4096 4096
ReadX 13867 32768 4096 4096
ReadX 13867 36864 4096 4096
ReadX 13867 40960 4096 4096
ReadX 13867 45056 4096 4096
ReadX 13867 49152 4096 4096
ReadX 13867 53248 4096 4096
ReadX 13867 57344 4096 4096
ReadX 13867 61440 4096 4096
ReadX 13867 65536 4096 4096
ReadX 13867 69632 4096 4096
ReadX 13867 73728 4096 4096
WriteX 13867 0 4096 4096
Close 13867
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13868
Close 13868
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13869
ReadX 13869 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13870
Close 13870
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13869
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13872
WriteX 13872 4607 1 1
QUERY_FILE_INFORMATION 13872
WriteX 13872 0 65471 65471
WriteX 13872 65471 65 65
WriteX 13872 65536 8866 8866
Close 13872
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13873
ReadX 13873 0 4096 4096
WriteX 13873 0 4096 4096
Flush 13873
WriteX 13873 0 4096 4096
Flush 13873
Close 13873
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13874
ReadX 13874 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13874
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13875
ReadX 13875 0 4096 4096
Close 13875
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13876
ReadX 13876 0 4096 4096
Close 13876
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13877
ReadX 13877 0 4096 4096
WriteX 13877 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13878
Close 13878
Close 13877
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13879
Close 13879
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13881
WriteX 13881 4607 1 1
QUERY_FILE_INFORMATION 13881
WriteX 13881 0 65471 65471
WriteX 13881 65471 65 65
WriteX 13881 65536 9298 9298
Close 13881
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13882
ReadX 13882 0 4096 4096
WriteX 13882 0 4096 4096
Flush 13882
WriteX 13882 0 4096 4096
Flush 13882
Close 13882
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13883
Close 13883
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13884
ReadX 13884 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13885
Close 13885
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13887
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13887 0 4096 4096
Close 13887
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13888
ReadX 13888 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13888 4096 4096 4096
ReadX 13888 8192 4096 4096
ReadX 13888 12288 4096 4096
ReadX 13888 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13884
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13889
ReadX 13889 0 4096 4096
Close 13889
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13890
ReadX 13890 0 4096 4096
Close 13890
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13891
ReadX 13891 0 4096 4096
WriteX 13891 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13892
Close 13892
Close 13888
Close 13891
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13893
Close 13893
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13895
WriteX 13895 4607 1 1
QUERY_FILE_INFORMATION 13895
WriteX 13895 0 65471 65471
WriteX 13895 65471 65 65
WriteX 13895 65536 11540 11540
Close 13895
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13896
ReadX 13896 0 4096 4096
WriteX 13896 0 4096 4096
Flush 13896
WriteX 13896 0 4096 4096
Flush 13896
Close 13896
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13897
Close 13897
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13898
ReadX 13898 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13899
Close 13899
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13898
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13900
ReadX 13900 0 65471 65471
ReadX 13900 65471 65 65
ReadX 13900 65536 65471 65471
ReadX 13900 131007 65 65
ReadX 13900 131072 65471 65471
ReadX 13900 196543 65 65
ReadX 13900 196608 65471 65471
ReadX 13900 262079 65 65
ReadX 13900 262144 65471 65471
ReadX 13900 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13901
ReadX 13901 0 65471 65471
ReadX 13901 65471 65 65
ReadX 13901 65536 65471 65471
ReadX 13901 131007 65 65
ReadX 13901 131072 65471 65471
ReadX 13901 196543 65 65
ReadX 13901 196608 65471 65471
ReadX 13901 262079 65 65
ReadX 13901 262144 65471 65471
ReadX 13901 327615 65 65
ReadX 13901 327680 65471 65471
ReadX 13901 393151 65 65
ReadX 13901 393216 65471 65471
ReadX 13901 458687 65 65
ReadX 13901 458752 65471 65471
ReadX 13901 524223 65 65
ReadX 13901 524288 65471 65471
ReadX 13901 589759 65 65
ReadX 13901 589824 65471 65471
ReadX 13901 655295 65 65
ReadX 13901 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13902
ReadX 13902 0 65471 65471
ReadX 13902 65471 65 65
ReadX 13902 65536 65471 65471
ReadX 13902 131007 65 65
ReadX 13902 131072 65471 65471
ReadX 13902 196543 65 65
ReadX 13902 196608 65471 65471
ReadX 13902 262079 65 65
ReadX 13902 262144 65471 65471
ReadX 13902 327615 65 65
ReadX 13902 327680 65471 65471
ReadX 13902 393151 65 65
ReadX 13902 393216 65471 65471
ReadX 13902 458687 65 65
ReadX 13902 458752 65471 65471
ReadX 13902 524223 65 65
ReadX 13902 524288 65471 65471
ReadX 13902 589759 65 65
ReadX 13902 589824 65471 65471
ReadX 13902 655295 65 65
ReadX 13902 655360 65471 65471
ReadX 13902 720831 65 65
ReadX 13902 720896 65471 65471
ReadX 13902 786367 65 65
ReadX 13902 786432 65471 65471
ReadX 13902 851903 65 65
ReadX 13902 851968 65471 65471
ReadX 13902 917439 65 65
ReadX 13902 917504 65471 65471
ReadX 13902 982975 65 65
ReadX 13902 983040 65471 65471
ReadX 13902 1048511 65 65
ReadX 13902 1048576 65471 65471
ReadX 13902 1114047 65 65
ReadX 13902 1114112 65471 65471
ReadX 13902 1179583 65 65
ReadX 13902 1179648 65471 65471
ReadX 13902 1245119 65 65
ReadX 13902 1245184 65471 65471
ReadX 13902 1310655 65 65
ReadX 13902 1310720 65471 65471
ReadX 13902 1376191 65 65
ReadX 13902 1376256 65471 65471
ReadX 13902 1441727 65 65
ReadX 13902 1441792 65471 65471
ReadX 13902 1507263 65 65
ReadX 13902 1507328 65471 65471
ReadX 13902 1572799 65 65
ReadX 13902 1572864 65471 65471
ReadX 13902 1638335 65 65
ReadX 13902 1638400 65471 65471
ReadX 13902 1703871 65 65
ReadX 13902 1703936 65471 65471
ReadX 13902 1769407 65 65
ReadX 13902 1769472 65471 65471
ReadX 13902 1834943 65 65
ReadX 13902 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13903
FIND_FIRST \clients\client1\~dmtmp\*
Close 13903
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13904
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13905
QUERY_FILE_INFORMATION 13905
QUERY_FILE_INFORMATION 13905
QUERY_FILE_INFORMATION 13905
ReadX 13905 2156 24 24
ReadX 13905 2139 276 276
ReadX 13905 2136 14 14
ReadX 13905 2136 7 7
ReadX 13905 2138 12 12
ReadX 13905 2137 8 8
ReadX 13905 2135 15 15
ReadX 13905 0 16 16
ReadX 13905 16 2048 2048
ReadX 13905 2064 2048 2048
ReadX 13905 257 2048 2048
ReadX 13905 385 2048 2048
ReadX 13905 513 2048 2048
ReadX 13905 641 2048 2048
ReadX 13905 769 2048 2048
ReadX 13905 897 2048 2048
ReadX 13905 1025 2048 2048
ReadX 13905 1153 2048 2048
ReadX 13905 1281 2048 2048
ReadX 13905 1409 2048 2048
ReadX 13905 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13907
Close 13907
Close 13853
Close 13900
Close 13901
Close 13902
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13909
WriteX 13909 15 1 1
QUERY_FILE_INFORMATION 13909
WriteX 13909 0 10575 10575
Flush 13909
Close 13909
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13910
Close 13910
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13911
ReadX 13911 0 4096 4096
Close 13905
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13912
Close 13912
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13913
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13914
QUERY_FILE_INFORMATION 13914
ReadX 13914 0 512 512
ReadX 13914 512 512 512
ReadX 13914 1024 512 512
QUERY_FILE_INFORMATION 13914
QUERY_FILE_INFORMATION 13914
Close 13914
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13915
QUERY_FILE_INFORMATION 13915
ReadX 13915 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13916
QUERY_FILE_INFORMATION 13916
ReadX 13916 0 512 512
ReadX 13916 512 512 512
ReadX 13916 1024 512 512
ReadX 13916 288 20 20
ReadX 13916 308 2084 2084
ReadX 13916 388 2084 2084
ReadX 13916 388 2084 2084
ReadX 13904 2157 1386 1386
ReadX 13916 2472 399 399
ReadX 13916 3072 1536 1536
ReadX 13916 544 149 149
ReadX 13916 693 485 485
Close 13916
ReadX 13904 2157 4096 4096
ReadX 13904 6253 4096 4096
ReadX 13904 10349 4096 4096
ReadX 13904 14445 4096 4096
ReadX 13904 18541 4096 4096
ReadX 13904 22637 256 256
ReadX 13904 22893 4096 4096
ReadX 13904 26989 4096 4096
ReadX 13904 31085 4096 4096
ReadX 13904 35181 4096 4096
ReadX 13904 39277 4096 4096
ReadX 13904 43373 4096 4096
ReadX 13904 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13904 2157 1024 1024
ReadX 13904 1667 4688 4688
ReadX 13904 6355 3516 3516
ReadX 13904 9871 16384 16384
ReadX 13904 26255 3771 3771
ReadX 13904 30026 2048 2048
ReadX 13904 32074 1024 1024
ReadX 13904 33098 6652 6652
ReadX 13904 39750 16384 16384
ReadX 13904 56134 10496 10496
ReadX 13904 66630 1784 1784
ReadX 13904 68414 90 90
ReadX 13904 68504 273 273
ReadX 13904 68777 1600 1600
ReadX 13904 70377 640 640
ReadX 13904 71017 1280 1280
ReadX 13904 72297 8464 8464
ReadX 13904 80761 158 158
ReadX 13904 80919 912 912
ReadX 13904 81831 1980 1980
ReadX 13904 83811 2256 2256
ReadX 13904 86067 400 400
ReadX 13904 86467 252 252
ReadX 13904 86719 42 42
ReadX 13904 86761 725 725
ReadX 13904 2009 512 512
ReadX 13904 3895 9 9
ReadX 13904 3781 46 46
ReadX 13904 4059 92 92
ReadX 13904 3781 92 92
ReadX 13904 3986 184 184
ReadX 13904 3987 16384 16384
ReadX 13904 3902 16384 16384
ReadX 13904 3781 10240 10240
ReadX 13904 3821 16384 16384
ReadX 13904 3891 935 935
ReadX 13904 4060 10240 10240
ReadX 13904 4059 184 184
ReadX 13904 256 184 184
ReadX 13904 256 1026 1026
ReadX 13904 3901 326 326
ReadX 13904 3899 652 652
ReadX 13904 256 2 2
ReadX 13904 258 4948 4948
Close 13904
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13918
Close 13918
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13920
WriteX 13920 4055 1 1
QUERY_FILE_INFORMATION 13920
WriteX 13920 0 65471 65471
WriteX 13920 65471 65 65
WriteX 13920 65536 65471 65471
WriteX 13920 131007 65 65
WriteX 13920 131072 65471 65471
WriteX 13920 196543 65 65
WriteX 13920 196608 65471 65471
WriteX 13920 262079 65 65
WriteX 13920 262144 65471 65471
WriteX 13920 327615 65 65
WriteX 13920 327680 65471 65471
WriteX 13920 393151 65 65
WriteX 13920 393216 65471 65471
WriteX 13920 458687 65 65
WriteX 13920 458752 65471 65471
WriteX 13920 524223 65 65
WriteX 13920 524288 65471 65471
WriteX 13920 589759 65 65
WriteX 13920 589824 35257 35257
Close 13920
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13922
Close 13922
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13924
WriteX 13924 4055 1 1
QUERY_FILE_INFORMATION 13924
WriteX 13924 0 65471 65471
WriteX 13924 65471 65 65
WriteX 13924 65536 65471 65471
WriteX 13924 131007 65 65
WriteX 13924 131072 65471 65471
WriteX 13924 196543 65 65
WriteX 13924 196608 65471 65471
WriteX 13924 262079 65 65
WriteX 13924 262144 65471 65471
WriteX 13924 327615 65 65
WriteX 13924 327680 65471 65471
WriteX 13924 393151 65 65
WriteX 13924 393216 65471 65471
WriteX 13924 458687 65 65
WriteX 13924 458752 65471 65471
WriteX 13924 524223 65 65
WriteX 13924 524288 65471 65471
WriteX 13924 589759 65 65
WriteX 13924 589824 57598 57598
Close 13924
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13926
WriteX 13926 15 1 1
QUERY_FILE_INFORMATION 13926
WriteX 13926 0 12543 12543
Flush 13926
Close 13926
Close 13911
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13927
Close 13927
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13928
ReadX 13928 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13929
FIND_FIRST \clients\client1\~dmtmp\*
Close 13929
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13930
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13931
QUERY_FILE_INFORMATION 13931
QUERY_FILE_INFORMATION 13931
QUERY_FILE_INFORMATION 13931
ReadX 13931 1938 24 24
ReadX 13931 1920 276 276
ReadX 13931 1918 14 14
ReadX 13931 1918 7 7
ReadX 13931 1919 12 12
ReadX 13931 1919 8 8
ReadX 13931 1917 15 15
ReadX 13931 0 16 16
ReadX 13931 16 2048 2048
ReadX 13931 2064 2048 2048
ReadX 13931 257 2048 2048
ReadX 13931 385 2048 2048
ReadX 13931 513 2048 2048
ReadX 13931 641 2048 2048
ReadX 13931 769 2048 2048
ReadX 13931 897 2048 2048
ReadX 13931 1025 2048 2048
ReadX 13931 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13933
Close 13933
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13935
WriteX 13935 15 1 1
QUERY_FILE_INFORMATION 13935
WriteX 13935 0 11588 11588
Flush 13935
Close 13935
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13936
Close 13936
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13937
ReadX 13937 0 4096 4096
Close 13931
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13939
WriteX 13939 15 1 1
QUERY_FILE_INFORMATION 13939
WriteX 13939 0 11615 11615
Flush 13939
Close 13939
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13937
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13940
Close 13940
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13941
ReadX 13941 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13943
Close 13943
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13945
WriteX 13945 4088 1 1
QUERY_FILE_INFORMATION 13945
WriteX 13945 0 65471 65471
WriteX 13945 65471 65 65
WriteX 13945 65536 16050 16050
Close 13945
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13930 1939 64 64
ReadX 13930 128 248 248
ReadX 13930 128 568 568
ReadX 13930 3872 1536 1536
ReadX 13930 3456 2560 2560
ReadX 13930 3136 512 512
ReadX 13930 2880 4096 4096
ReadX 13930 3264 3072 3072
ReadX 13930 320 4096 4096
ReadX 13930 1024 4096 4096
ReadX 13930 3616 4096 4096
ReadX 13930 1939 64 64
ReadX 13930 128 248 248
ReadX 13930 128 608 608
ReadX 13930 2858 1024 1024
ReadX 13930 2810 4096 4096
ReadX 13930 2826 4096 4096
ReadX 13930 2580 2048 2048
ReadX 13930 2800 2560 2560
ReadX 13930 2100 4096 4096
ReadX 13930 2084 4096 4096
ReadX 13930 868 4096 4096
ReadX 13930 2324 4096 4096
ReadX 13930 884 4096 4096
ReadX 13930 2604 1024 1024
ReadX 13930 580 4096 4096
ReadX 13930 596 4096 4096
ReadX 13930 2752 4096 4096
ReadX 13930 2842 1024 1024
ReadX 13930 660 4096 4096
ReadX 13930 2720 4096 4096
ReadX 13930 2736 4096 4096
ReadX 13930 628 4096 4096
ReadX 13930 2704 4096 4096
ReadX 13930 1556 4096 4096
ReadX 13930 576 4096 4096
ReadX 13930 3168 1536 1536
ReadX 13930 832 4096 4096
ReadX 13930 1088 4096 4096
ReadX 13930 1344 4096 4096
ReadX 13930 1600 4096 4096
ReadX 13930 1856 4096 4096
ReadX 13930 2112 4096 4096
ReadX 13930 1892 4096 4096
ReadX 13930 820 4096 4096
ReadX 13930 788 4096 4096
ReadX 13930 1604 4096 4096
ReadX 13930 3648 4096 4096
ReadX 13930 2608 4096 4096
ReadX 13930 548 4096 4096
ReadX 13930 740 4096 4096
ReadX 13930 1344 4096 4096
ReadX 13930 3392 4096 4096
ReadX 13930 3904 4096 4096
ReadX 13930 644 4096 4096
ReadX 13930 676 4096 4096
ReadX 13930 2688 4096 4096
ReadX 13930 320 4096 4096
ReadX 13930 900 4096 4096
ReadX 13930 1908 4096 4096
ReadX 13930 852 4096 4096
ReadX 13930 724 4096 4096
ReadX 13930 2292 4096 4096
ReadX 13930 612 4096 4096
ReadX 13930 388 4096 4096
ReadX 13930 2368 4096 4096
ReadX 13930 2624 4096 4096
ReadX 13930 500 4096 4096
ReadX 13930 356 4096 4096
ReadX 13930 1024 4096 4096
ReadX 13930 576 4096 4096
ReadX 13930 340 4096 4096
ReadX 13930 420 4096 4096
ReadX 13930 1600 4096 4096
ReadX 13930 404 4096 4096
ReadX 13930 1428 4096 4096
ReadX 13930 2656 4096 4096
ReadX 13930 2624 4096 4096
ReadX 13930 452 4096 4096
ReadX 13930 692 4096 4096
ReadX 13930 564 4096 4096
ReadX 13930 372 4096 4096
ReadX 13930 468 4096 4096
ReadX 13930 484 4096 4096
ReadX 13930 1088 4096 4096
ReadX 13930 1924 4096 4096
ReadX 13930 2768 4096 4096
ReadX 13930 832 4096 4096
ReadX 13930 836 4096 4096
ReadX 13930 1856 4096 4096
ReadX 13930 2640 4096 4096
ReadX 13930 436 4096 4096
ReadX 13930 1828 4096 4096
ReadX 13930 804 4096 4096
ReadX 13930 1860 4096 4096
ReadX 13930 1812 4096 4096
ReadX 13930 756 4096 4096
ReadX 13930 1636 4096 4096
ReadX 13930 772 4096 4096
ReadX 13930 2036 4096 4096
ReadX 13930 1220 4096 4096
ReadX 13930 1652 4096 4096
ReadX 13930 2588 4096 4096
ReadX 13930 916 4096 4096
ReadX 13930 260 4096 4096
ReadX 13930 932 4096 4096
ReadX 13930 2624 4096 4096
ReadX 13930 308 4096 4096
ReadX 13930 292 4096 4096
ReadX 13930 1140 4096 4096
ReadX 13930 276 4096 4096
ReadX 13930 2020 4096 4096
ReadX 13930 2880 4096 4096
ReadX 13930 516 4096 4096
ReadX 13930 1844 4096 4096
ReadX 13930 1124 4096 4096
ReadX 13930 3136 4096 4096
ReadX 13930 324 4096 4096
ReadX 13930 1156 4096 4096
ReadX 13930 1172 4096 4096
ReadX 13930 2112 4096 4096
ReadX 13930 2368 4096 4096
ReadX 13930 964 4096 4096
ReadX 13930 980 4096 4096
ReadX 13930 1012 4096 4096
ReadX 13930 532 4096 4096
ReadX 13930 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13930 1620 4096 4096
ReadX 13930 1604 4096 4096
ReadX 13930 2116 4096 4096
ReadX 13930 2132 4096 4096
ReadX 13930 2148 4096 4096
ReadX 13930 2276 4096 4096
ReadX 13930 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13947
Close 13947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13949
QUERY_FILE_INFORMATION 13913
Close 13913
WriteX 13949 4088 1 1
QUERY_FILE_INFORMATION 13949
QUERY_FILE_INFORMATION 13915
Close 13915
WriteX 13949 0 65471 65471
WriteX 13949 65471 65 65
WriteX 13949 65536 64850 64850
Close 13949
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13951
WriteX 13951 15 1 1
QUERY_FILE_INFORMATION 13951
ReadX 13930 2068 4096 4096
ReadX 13930 1588 4096 4096
ReadX 13930 1572 4096 4096
WriteX 13951 0 18630 18630
Flush 13951
Close 13951
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13941
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13952
Close 13952
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13953
ReadX 13953 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13930 612 4096 4096
ReadX 13930 564 4096 4096
ReadX 13930 1876 4096 4096
ReadX 13930 628 4096 4096
ReadX 13930 740 4096 4096
ReadX 13930 724 4096 4096
ReadX 13930 644 4096 4096
ReadX 13930 2324 4096 4096
ReadX 13930 660 4096 4096
ReadX 13930 852 4096 4096
ReadX 13930 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13930 2368 4096 4096
ReadX 13930 1024 4096 4096
ReadX 13930 320 4096 4096
ReadX 13930 580 4096 4096
ReadX 13930 3136 512 512
ReadX 13930 2880 4096 4096
Close 13930
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13954
ReadX 13954 61440 4096 4096
ReadX 13954 126976 4096 4096
WriteX 13954 0 65471 65471
WriteX 13954 65471 65 65
WriteX 13954 65536 65471 65471
WriteX 13954 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13955
ReadX 13955 61440 4096 4096
ReadX 13955 126976 4096 4096
ReadX 13955 192512 4096 4096
ReadX 13955 258048 4096 4096
WriteX 13955 0 65471 65471
WriteX 13955 65471 65 65
WriteX 13955 65536 65471 65471
WriteX 13955 131007 65 65
WriteX 13955 131072 65471 65471
WriteX 13955 196543 65 65
WriteX 13955 196608 65471 65471
WriteX 13955 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13956
ReadX 13956 61440 4096 4096
ReadX 13956 126976 4096 4096
ReadX 13956 192512 4096 4096
ReadX 13956 258048 4096 4096
ReadX 13956 323584 4096 4096
ReadX 13956 389120 4096 4096
ReadX 13956 454656 4096 4096
ReadX 13956 520192 4096 4096
WriteX 13956 0 65471 65471
WriteX 13956 65471 65 65
WriteX 13956 65536 65471 65471
WriteX 13956 131007 65 65
WriteX 13956 131072 65471 65471
WriteX 13956 196543 65 65
WriteX 13956 196608 65471 65471
WriteX 13956 262079 65 65
WriteX 13956 262144 65471 65471
WriteX 13956 327615 65 65
WriteX 13956 327680 65471 65471
WriteX 13956 393151 65 65
WriteX 13956 393216 65471 65471
WriteX 13956 458687 65 65
WriteX 13956 458752 65471 65471
WriteX 13956 524223 65 65
Close 13953
Close 13928
Close 13954
Close 13955
Close 13956
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13957
Close 13957
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13958
Close 13958
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13961
Close 13961
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13963
Close 13963
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13964
Close 13964
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13967
Close 13967
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13969
Close 13969
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13970
Close 13970
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13973
Close 13973
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13977
Close 13977
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13981
Close 13981
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13985
Close 13985
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13989
Close 13989
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13993
Close 13993
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13997
Close 13997
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 14001
Close 14001
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 14003
Close 14003
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 14005
Close 14005
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 14007
WriteX 14007 4095 1 1
QUERY_FILE_INFORMATION 14007
QUERY_FS_INFORMATION 259
WriteX 14007 0 65471 65471
WriteX 14007 65471 65 65
WriteX 14007 65536 65471 65471
WriteX 14007 131007 65 65
WriteX 14007 131072 65471 65471
WriteX 14007 196543 65 65
WriteX 14007 196608 65471 65471
WriteX 14007 262079 65 65
WriteX 14007 262144 26634 26634
Close 14007
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14012
Close 14012
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14013
Close 14013
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14014
ReadX 14014 0 4096 4096
Close 14014
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14015
ReadX 14015 0 4096 4096
ReadX 14015 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14016
Close 14016
Close 14015
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14019
Close 14019
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14021
Close 14021
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14022
Close 14022
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 14025
Close 14025
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 14027
Close 14027
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14028
Close 14028
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14031
Close 14031
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14035
Close 14035
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14039
Close 14039
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14043
Close 14043
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14047
Close 14047
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14051
Close 14051
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 14054
Close 14054
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 14058
Close 14058
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 14062
Close 14062
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 14064
Close 14064
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 14065
Close 14065
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 14074
Close 14074
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 14075
FIND_FIRST \clients\client1\~dmtmp\*
Close 14075
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 14076
Close 14076
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 14077
ReadX 14077 0 4096 4096
Close 14077
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 14078
ReadX 14078 0 4096 4096
Close 14078
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 14079
ReadX 14079 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 14089
Close 14089
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 14090
FIND_FIRST \clients\client1\~dmtmp\*
Close 14090
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 14091
Close 14091
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 14092
ReadX 14092 0 4096 4096
Close 14092
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 14093
ReadX 14093 0 4096 4096
Close 14093
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 14094
ReadX 14094 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14095
ReadX 14095 0 65471 65471
ReadX 14095 65471 65 65
ReadX 14095 65536 65471 65471
ReadX 14095 131007 65 65
ReadX 14095 131072 65471 65471
ReadX 14095 196543 65 65
ReadX 14095 196608 65471 65471
ReadX 14095 262079 65 65
ReadX 14095 262144 65471 65471
ReadX 14095 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13624
ReadX 13624 0 65471 65471
ReadX 13624 65471 65 65
ReadX 13624 65536 65471 65471
ReadX 13624 131007 65 65
ReadX 13624 131072 65471 65471
ReadX 13624 196543 65 65
ReadX 13624 196608 65471 65471
ReadX 13624 262079 65 65
ReadX 13624 262144 65471 65471
ReadX 13624 327615 65 65
ReadX 13624 327680 65471 65471
ReadX 13624 393151 65 65
ReadX 13624 393216 65471 65471
ReadX 13624 458687 65 65
ReadX 13624 458752 65471 65471
ReadX 13624 524223 65 65
ReadX 13624 524288 65471 65471
ReadX 13624 589759 65 65
ReadX 13624 589824 65471 65471
ReadX 13624 655295 65 65
ReadX 13624 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13625
ReadX 13625 0 65471 65471
ReadX 13625 65471 65 65
ReadX 13625 65536 65471 65471
ReadX 13625 131007 65 65
ReadX 13625 131072 65471 65471
ReadX 13625 196543 65 65
ReadX 13625 196608 65471 65471
ReadX 13625 262079 65 65
ReadX 13625 262144 65471 65471
ReadX 13625 327615 65 65
ReadX 13625 327680 65471 65471
ReadX 13625 393151 65 65
ReadX 13625 393216 65471 65471
ReadX 13625 458687 65 65
ReadX 13625 458752 65471 65471
ReadX 13625 524223 65 65
ReadX 13625 524288 65471 65471
ReadX 13625 589759 65 65
ReadX 13625 589824 65471 65471
ReadX 13625 655295 65 65
ReadX 13625 655360 65471 65471
ReadX 13625 720831 65 65
ReadX 13625 720896 65471 65471
ReadX 13625 786367 65 65
ReadX 13625 786432 65471 65471
ReadX 13625 851903 65 65
ReadX 13625 851968 65471 65471
ReadX 13625 917439 65 65
ReadX 13625 917504 65471 65471
ReadX 13625 982975 65 65
ReadX 13625 983040 65471 65471
ReadX 13625 1048511 65 65
ReadX 13625 1048576 65471 65471
ReadX 13625 1114047 65 65
ReadX 13625 1114112 65471 65471
ReadX 13625 1179583 65 65
ReadX 13625 1179648 65471 65471
ReadX 13625 1245119 65 65
ReadX 13625 1245184 65471 65471
ReadX 13625 1310655 65 65
ReadX 13625 1310720 65471 65471
ReadX 13625 1376191 65 65
ReadX 13625 1376256 65471 65471
ReadX 13625 1441727 65 65
ReadX 13625 1441792 65471 65471
ReadX 13625 1507263 65 65
ReadX 13625 1507328 65471 65471
ReadX 13625 1572799 65 65
ReadX 13625 1572864 65471 65471
ReadX 13625 1638335 65 65
ReadX 13625 1638400 65471 65471
ReadX 13625 1703871 65 65
ReadX 13625 1703936 65471 65471
ReadX 13625 1769407 65 65
ReadX 13625 1769472 65471 65471
ReadX 13625 1834943 65 65
ReadX 13625 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13626
ReadX 13626 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13626 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13626 8192 4096 4096
ReadX 13626 12288 4096 4096
ReadX 13626 16384 4096 4096
ReadX 13626 20480 4096 4096
ReadX 13626 24576 4096 4096
ReadX 13626 28672 4096 4096
ReadX 13626 32768 4096 4096
ReadX 13626 36864 4096 4096
ReadX 13626 40960 4096 4096
ReadX 13626 45056 4096 4096
ReadX 13626 49152 4096 4096
ReadX 13626 53248 4096 4096
ReadX 13626 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13626 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13627
Close 13627
Close 14079
Close 14094
Close 14095
Close 13624
Close 13625
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13628
WriteX 13628 1535 1 1
QUERY_FILE_INFORMATION 13628
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13626 0 4096 4096
ReadX 13626 4096 4096 4096
QUERY_FILE_INFORMATION 13628
WriteX 13628 0 57088 57088
WriteX 13628 0 4096 4096
Flush 13628
Close 13626
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13629
Close 13629
WriteX 13628 0 4096 4096
Close 13628
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13630
Close 13630
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13631
ReadX 13631 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13631 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13632
WriteX 13632 1535 1 1
QUERY_FILE_INFORMATION 13632
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13631 0 4096 4096
QUERY_FILE_INFORMATION 13632
WriteX 13632 0 51456 51456
WriteX 13632 0 4096 4096
Flush 13632
Close 13631
WriteX 13632 0 4096 4096
Close 13632
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13633
Close 13633
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13634
ReadX 13634 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13634 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13636
Close 13636
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13638
WriteX 13638 4045 1 1
QUERY_FILE_INFORMATION 13638
WriteX 13638 0 53077 53077
Close 13638
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13639
WriteX 13639 1535 1 1
QUERY_FILE_INFORMATION 13639
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13634 0 4096 4096
QUERY_FILE_INFORMATION 13639
WriteX 13639 0 65471 65471
WriteX 13639 65471 65 65
WriteX 13639 65536 1856 1856
WriteX 13639 0 4096 4096
Flush 13639
Close 13634
WriteX 13639 0 4096 4096
Close 13639
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13640
Close 13640
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13641
ReadX 13641 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13643
Close 13643
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13645
WriteX 13645 4076 1 1
QUERY_FILE_INFORMATION 13645
WriteX 13645 0 7983 7983
Close 13645
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13647
Close 13647
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13649
WriteX 13649 4095 1 1
QUERY_FILE_INFORMATION 13649
WriteX 13649 0 65471 65471
WriteX 13649 65471 65 65
WriteX 13649 65536 65471 65471
WriteX 13649 131007 65 65
WriteX 13649 131072 65471 65471
WriteX 13649 196543 65 65
WriteX 13649 196608 65471 65471
WriteX 13649 262079 65 65
WriteX 13649 262144 65471 65471
WriteX 13649 327615 65 65
WriteX 13649 327680 65471 65471
WriteX 13649 393151 65 65
WriteX 13649 393216 65471 65471
WriteX 13649 458687 65 65
WriteX 13649 458752 46731 46731
Close 13649
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13650
WriteX 13650 1535 1 1
QUERY_FILE_INFORMATION 13650
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13641 0 4096 4096
ReadX 13641 4096 4096 4096
QUERY_FILE_INFORMATION 13650
WriteX 13650 0 65471 65471
WriteX 13650 65471 65 65
WriteX 13650 65536 22848 22848
WriteX 13650 0 4096 4096
Flush 13650
Close 13641
WriteX 13650 0 4096 4096
Close 13650
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13651
Close 13651
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13652
ReadX 13652 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13652 4096 4096 4096
Close 13652
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13653
ReadX 13653 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13653 0 8192 8192
ReadX 13653 8192 4096 4096
ReadX 13653 12288 4096 4096
ReadX 13653 16384 4096 4096
ReadX 13653 20480 4096 4096
ReadX 13653 24576 4096 4096
ReadX 13653 28672 4096 4096
ReadX 13653 32768 4096 4096
ReadX 13653 36864 4096 4096
ReadX 13653 40960 4096 4096
ReadX 13653 45056 4096 4096
ReadX 13653 49152 4096 4096
ReadX 13653 53248 4096 4096
ReadX 13653 57344 4096 4096
ReadX 13653 61440 4096 4096
ReadX 13653 65536 4096 4096
ReadX 13653 69632 4096 4096
ReadX 13653 73728 4096 4096
ReadX 13653 77824 4096 4096
ReadX 13653 81920 4096 4096
ReadX 13653 86016 4096 4096
ReadX 13653 90112 4096 4096
ReadX 13653 94208 4096 4096
ReadX 13653 98304 4096 4096
ReadX 13653 102400 4096 4096
ReadX 13653 106496 4096 4096
ReadX 13653 110592 4096 4096
ReadX 13653 114688 4096 4096
ReadX 13653 118784 4096 4096
ReadX 13653 122880 4096 4096
ReadX 13653 126976 4096 4096
ReadX 13653 131072 4096 4096
ReadX 13653 135168 4096 4096
ReadX 13653 139264 4096 4096
ReadX 13653 143360 4096 4096
ReadX 13653 147456 4096 4096
ReadX 13653 151552 4096 4096
ReadX 13653 155648 4096 4096
ReadX 13653 159744 4096 4096
ReadX 13653 163840 4096 4096
ReadX 13653 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13653 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13654
Close 13654
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13655
WriteX 13655 2047 1 1
QUERY_FILE_INFORMATION 13655
Close 13653
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13656
Close 13656
WriteX 13655 0 42388 42388
Close 13655
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13657
Close 13657
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13658
ReadX 13658 0 4096 4096
ReadX 13658 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13659
WriteX 13659 2047 1 1
QUERY_FILE_INFORMATION 13659
Close 13658
WriteX 13659 0 42652 42652
Close 13659
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13660
Close 13660
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13661
ReadX 13661 0 4096 4096
ReadX 13661 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13663
Close 13663
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13665
WriteX 13665 4080 1 1
QUERY_FILE_INFORMATION 13665
WriteX 13665 0 65471 65471
WriteX 13665 65471 65 65
WriteX 13665 65536 49 49
Close 13665
Close 13661
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13666
ReadX 13666 61440 4096 4096
ReadX 13666 126976 4096 4096
WriteX 13666 0 65471 65471
WriteX 13666 65471 65 65
WriteX 13666 65536 65471 65471
WriteX 13666 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13667
ReadX 13667 61440 4096 4096
ReadX 13667 126976 4096 4096
ReadX 13667 192512 4096 4096
ReadX 13667 258048 4096 4096
WriteX 13667 0 65471 65471
WriteX 13667 65471 65 65
WriteX 13667 65536 65471 65471
WriteX 13667 131007 65 65
WriteX 13667 131072 65471 65471
WriteX 13667 196543 65 65
WriteX 13667 196608 65471 65471
WriteX 13667 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13668
ReadX 13668 61440 4096 4096
ReadX 13668 126976 4096 4096
ReadX 13668 192512 4096 4096
ReadX 13668 258048 4096 4096
ReadX 13668 323584 4096 4096
ReadX 13668 389120 4096 4096
ReadX 13668 454656 4096 4096
ReadX 13668 520192 4096 4096
WriteX 13668 0 65471 65471
WriteX 13668 65471 65 65
WriteX 13668 65536 65471 65471
WriteX 13668 131007 65 65
WriteX 13668 131072 65471 65471
WriteX 13668 196543 65 65
WriteX 13668 196608 65471 65471
WriteX 13668 262079 65 65
WriteX 13668 262144 65471 65471
WriteX 13668 327615 65 65
WriteX 13668 327680 65471 65471
WriteX 13668 393151 65 65
WriteX 13668 393216 65471 65471
WriteX 13668 458687 65 65
WriteX 13668 458752 65471 65471
WriteX 13668 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13669
FIND_FIRST \clients\client1\~dmtmp\*
Close 13669
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13670
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13670 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13671
ReadX 13671 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13672
ReadX 13672 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13673
ReadX 13673 0 4096 4096
ReadX 13670 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13670
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13674
ReadX 13674 0 4096 4096
ReadX 13674 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13675
FIND_FIRST \clients\client1\~dmtmp\*
Close 13675
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13676
QUERY_FILE_INFORMATION 13676
WriteX 13676 2047 1 1
QUERY_FILE_INFORMATION 13676
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13677
Close 13677
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13678
WriteX 13678 52 1 1
QUERY_FILE_INFORMATION 13678
WriteX 13678 0 491 491
Close 13678
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13679
ReadX 13679 0 491 491
WriteX 13676 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13674
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13680
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13680 0 4096 4096
ReadX 13680 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13682
Close 13682
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13683
WriteX 13683 52 1 1
QUERY_FILE_INFORMATION 13683
WriteX 13683 0 543 543
Close 13683
Close 13680
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13684
ReadX 13684 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13685
ReadX 13685 0 543 543
ReadX 13684 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13684
Close 13679
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13666
Close 13667
Close 13668
Close 13685
Close 13671
Close 13672
Close 13673
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13676
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13686
FIND_FIRST \clients\client1\~dmtmp\*
Close 13686
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13687
ReadX 13687 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13688
ReadX 13688 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13689
ReadX 13689 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13690
ReadX 13690 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13691
ReadX 13691 0 543 543
ReadX 13687 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13695
FIND_FIRST \clients\client1\~dmtmp\*
Close 13695
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13696
QUERY_FILE_INFORMATION 13696
WriteX 13696 2047 1 1
QUERY_FILE_INFORMATION 13696
WriteX 13696 0 2048 2048
Close 13696
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13697
ReadX 13697 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13691
Close 13697
Close 13687
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13698
ReadX 13698 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13698 4095 1 1
QUERY_FILE_INFORMATION 13698
ReadX 13698 0 4096 4096
WriteX 13698 0 4096 4096
Flush 13698
WriteX 13698 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13699
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13699 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13700
ReadX 13700 0 543 543
ReadX 13699 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13704
FIND_FIRST \clients\client1\~dmtmp\*
Close 13704
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13705
WriteX 13705 2047 1 1
QUERY_FILE_INFORMATION 13705
WriteX 13705 0 2048 2048
Close 13705
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13706
ReadX 13706 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13710
Close 13710
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13711
WriteX 13711 2047 1 1
QUERY_FILE_INFORMATION 13711
WriteX 13711 0 2048 2048
Close 13711
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13712
ReadX 13712 0 2048 2048
ReadX 13699 4096 16384 16384
Close 13712
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13713
ReadX 13713 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13713
Close 13700
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13706 4095 1 1
QUERY_FILE_INFORMATION 13706
ReadX 13706 0 4096 4096
WriteX 13706 0 4096 4096
Close 13706
WriteX 13699 0 8192 8192
Close 13699
WriteX 13688 0 4096 4096
WriteX 13689 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13715
ReadX 13715 0 4096 4096
ReadX 13715 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13715
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13716
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13716 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13717
ReadX 13717 0 543 543
ReadX 13716 0 4096 4096
Close 13716
Close 13698
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13718
QUERY_FILE_INFORMATION 13718
Close 13718
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13717
Close 13688
Close 13689
Close 13690
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13719
FIND_FIRST \clients\client1\~dmtmp\*
Close 13719
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13720
ReadX 13720 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13721
ReadX 13721 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13722
ReadX 13722 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13723
ReadX 13723 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13724
ReadX 13724 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13725
ReadX 13725 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13726
ReadX 13726 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13727
ReadX 13727 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13728
ReadX 13728 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13729
ReadX 13729 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13730
ReadX 13730 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13731
ReadX 13731 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13732
ReadX 13732 0 4096 4096
ReadX 13720 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13736
FIND_FIRST \clients\client1\~dmtmp\*
Close 13736
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13737
QUERY_FILE_INFORMATION 13737
WriteX 13737 2047 1 1
QUERY_FILE_INFORMATION 13737
WriteX 13737 0 2048 2048
Close 13737
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13738
ReadX 13738 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13738
Close 13728
Close 13720
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13739
ReadX 13739 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13740
FIND_FIRST \clients\client1\~dmtmp\*
Close 13740
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13741
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13741 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13742
ReadX 13742 0 4096 4096
ReadX 13741 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13746
FIND_FIRST \clients\client1\~dmtmp\*
Close 13746
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13747
QUERY_FILE_INFORMATION 13747
WriteX 13747 2047 1 1
QUERY_FILE_INFORMATION 13747
WriteX 13747 0 2048 2048
Close 13747
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13748
ReadX 13748 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13748
Close 13741
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13749
ReadX 13749 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13739 4095 1 1
QUERY_FILE_INFORMATION 13739
ReadX 13739 0 4096 4096
WriteX 13739 0 4096 4096
Flush 13739
WriteX 13749 4095 1 1
QUERY_FILE_INFORMATION 13749
ReadX 13749 0 4096 4096
WriteX 13749 0 4096 4096
Flush 13749
WriteX 13739 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 13749 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13750
ReadX 13750 0 4096 4096
ReadX 13742 0 4096 4096
ReadX 13750 0 4096 4096
ReadX 13750 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13751
FIND_FIRST \clients\client1\~dmtmp\*
Close 13751
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13752
WriteX 13752 4095 1 1
QUERY_FILE_INFORMATION 13752
WriteX 13752 0 4096 4096
Close 13752
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13753
ReadX 13753 0 4096 4096
Close 13750
Close 13742
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13754
Close 13754
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13755
WriteX 13755 4095 1 1
QUERY_FILE_INFORMATION 13755
WriteX 13755 0 4096 4096
Close 13755
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13756
ReadX 13756 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 13756 0 4096 4096
Close 13753
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13732
Close 13726
Close 13729
Close 13730
Close 13731
Close 13727
Close 13721
Close 13724
Close 13725
Close 13722
Close 13723
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13756
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13758
Close 13758
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13759
ReadX 13759 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13760
Close 13760
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13761
WriteX 13761 2047 1 1
QUERY_FILE_INFORMATION 13761
WriteX 13761 0 2048 2048
Close 13761
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13762
ReadX 13762 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13762
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13763
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13763 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13764
ReadX 13764 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13765
ReadX 13765 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13766
ReadX 13766 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13767
ReadX 13767 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13768
ReadX 13768 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13769
ReadX 13769 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13770
ReadX 13770 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13771
ReadX 13771 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13772
ReadX 13772 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13773
ReadX 13773 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13774
ReadX 13774 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13775
ReadX 13775 0 4096 4096
ReadX 13763 0 4096 4096
ReadX 13770 0 4096 4096
Close 13770
Close 13763
Close 13739
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13776
QUERY_FILE_INFORMATION 13776
Close 13776
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13759
Close 13774
Close 13769
Close 13771
Close 13772
Close 13773
Close 13775
Close 13764
Close 13767
Close 13768
Close 13765
Close 13766
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13749
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13777
QUERY_FILE_INFORMATION 13777
Close 13777
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13778
FIND_FIRST \clients\client1\~dmtmp\*
Close 13778
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13779
ReadX 13779 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13780
ReadX 13780 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13781
ReadX 13781 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13782
ReadX 13782 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13783
ReadX 13783 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13784
ReadX 13784 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13785
ReadX 13785 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13786
ReadX 13786 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13787
ReadX 13787 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13788
ReadX 13788 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13789
ReadX 13789 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13790
ReadX 13790 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13791
ReadX 13791 0 4096 4096
ReadX 13779 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13795
FIND_FIRST \clients\client1\~dmtmp\*
Close 13795
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13796
QUERY_FILE_INFORMATION 13796
WriteX 13796 2047 1 1
QUERY_FILE_INFORMATION 13796
WriteX 13796 0 2048 2048
Close 13796
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13797
ReadX 13797 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13797
Close 13779
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13798
ReadX 13798 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13799
FIND_FIRST \clients\client1\~dmtmp\*
Close 13799
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13800
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13800 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13801
ReadX 13801 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13802
ReadX 13802 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13803
ReadX 13803 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13804
ReadX 13804 0 543 543
ReadX 13800 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13808
FIND_FIRST \clients\client1\~dmtmp\*
Close 13808
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13809
QUERY_FILE_INFORMATION 13809
WriteX 13809 2047 1 1
QUERY_FILE_INFORMATION 13809
WriteX 13809 0 2048 2048
Close 13809
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13810
ReadX 13810 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13810
Close 13800
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13811
ReadX 13811 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 13784
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13812
FIND_FIRST \clients\client1\~dmtmp\*
Close 13812
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13813
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13813 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13814
ReadX 13814 0 4096 4096
ReadX 13813 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13818
FIND_FIRST \clients\client1\~dmtmp\*
Close 13818
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13819
QUERY_FILE_INFORMATION 13819
WriteX 13819 2047 1 1
QUERY_FILE_INFORMATION 13819
WriteX 13819 0 2048 2048
Close 13819
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13820
ReadX 13820 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13820
Close 13814
Close 13813
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13821
ReadX 13821 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13798 4095 1 1
QUERY_FILE_INFORMATION 13798
ReadX 13798 0 4096 4096
WriteX 13798 0 4096 4096
Flush 13798
WriteX 13811 4095 1 1
QUERY_FILE_INFORMATION 13811
ReadX 13811 0 4096 4096
WriteX 13811 0 4096 4096
Flush 13811
WriteX 13821 4095 1 1
QUERY_FILE_INFORMATION 13821
ReadX 13821 0 4096 4096
WriteX 13821 0 4096 4096
Flush 13821
WriteX 13798 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 13811 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 13821 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13822
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13822 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13823
ReadX 13823 0 4096 4096
ReadX 13822 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13824
ReadX 13824 0 4096 4096
ReadX 13824 0 4096 4096
ReadX 13824 4096 16384 16384
ReadX 13822 4096 16384 16384
ReadX 13822 0 4096 4096
ReadX 13823 0 4096 4096
ReadX 13823 4096 4096 4096
Close 13824
Close 13823
Close 13822
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13825
FIND_FIRST \clients\client1\~dmtmp\*
Close 13825
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13826
ReadX 13826 0 2048 2048
WriteX 13826 18431 1 1
QUERY_FILE_INFORMATION 13826
WriteX 13826 0 19584 19584
Close 13826
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13827
ReadX 13827 0 4096 4096
ReadX 13827 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13827
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13828
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13828 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13829
ReadX 13829 0 4096 4096
ReadX 13828 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13830
ReadX 13830 0 4096 4096
ReadX 13830 0 4096 4096
Close 13830
Close 13829
Close 13828
Close 13798
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13831
QUERY_FILE_INFORMATION 13831
Close 13831
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13804
Close 13791
Close 13783
Close 13801
Close 13802
Close 13803
Close 13790
Close 13785
Close 13788
Close 13789
Close 13786
Close 13787
Close 13780
Close 13781
Close 13782
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13811
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13832
QUERY_FILE_INFORMATION 13832
Close 13832
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13821
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13833
QUERY_FILE_INFORMATION 13833
Close 13833
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13834
FIND_FIRST \clients\client1\~dmtmp\*
Close 13834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13835
ReadX 13835 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13836
ReadX 13836 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13837
ReadX 13837 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13838
ReadX 13838 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13839
ReadX 13839 0 543 543
ReadX 13835 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13835 4096 16384 16384
WriteX 13835 0 4096 4096
Close 13835
WriteX 13836 0 4096 4096
WriteX 13837 0 4096 4096
WriteX 13838 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13840
FIND_FIRST \clients\client1\~dmtmp\*
Close 13840
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13841
ReadX 13841 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13842
ReadX 13842 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13843
ReadX 13843 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13844
ReadX 13844 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13845
ReadX 13845 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13846
ReadX 13846 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13847
ReadX 13847 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13848
ReadX 13848 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13849
ReadX 13849 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13850
ReadX 13850 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13851
ReadX 13851 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13852
ReadX 13852 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13853
ReadX 13853 0 4096 4096
ReadX 13841 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13854
ReadX 13854 0 8192 8192
ReadX 13841 4096 16384 16384
Close 13848
Close 13841
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13855
FIND_FIRST \clients\client1\~dmtmp\*
Close 13855
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13856
ReadX 13856 0 4096 4096
ReadX 13856 4096 4096 4096
ReadX 13856 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13857
ReadX 13857 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13858
ReadX 13858 0 4096 4096
ReadX 13857 0 4096 4096
ReadX 13857 0 4096 4096
ReadX 13857 4096 16384 16384
Close 13858
WriteX 13857 0 4096 4096
Close 13857
WriteX 13842 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13859
FIND_FIRST \clients\client1\~dmtmp\*
Close 13859
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13860
ReadX 13860 0 4096 4096
ReadX 13860 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13861
ReadX 13861 0 4096 4096
ReadX 13861 0 4096 4096
WriteX 13861 0 4096 4096
Close 13861
WriteX 13836 0 4096 4096
WriteX 13837 0 4096 4096
WriteX 13838 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13862
ReadX 13862 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13863
ReadX 13863 0 4096 4096
ReadX 13862 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13867
FIND_FIRST \clients\client1\~dmtmp\*
Close 13867
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13868
QUERY_FILE_INFORMATION 13868
WriteX 13868 2047 1 1
QUERY_FILE_INFORMATION 13868
WriteX 13868 0 2048 2048
Close 13868
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13869
ReadX 13869 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13869 4095 1 1
QUERY_FILE_INFORMATION 13869
ReadX 13869 0 4096 4096
WriteX 13869 0 4096 4096
Close 13869
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13870
ReadX 13870 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13870 0 4096 4096
Close 13863
Close 13862
WriteX 13870 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13871
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13871 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13872
ReadX 13872 0 4096 4096
ReadX 13871 0 4096 4096
ReadX 13871 4096 16384 16384
Close 13872
Close 13871
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13873
FIND_FIRST \clients\client1\~dmtmp\*
Close 13873
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13874
ReadX 13874 0 4096 4096
ReadX 13874 4096 4096 4096
WriteX 13874 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13874 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13874
ReadX 13870 0 4096 4096
WriteX 13870 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13875
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13875 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13876
ReadX 13876 0 4096 4096
ReadX 13875 0 4096 4096
ReadX 13875 4096 16384 16384
Close 13876
Close 13875
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13877
FIND_FIRST \clients\client1\~dmtmp\*
Close 13877
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13878
ReadX 13878 0 4096 4096
ReadX 13878 4096 4096 4096
WriteX 13878 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13878 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13878
Close 13870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13879
QUERY_FILE_INFORMATION 13879
Close 13879
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13854
Close 13856
Close 13860
Close 13839
Close 13836
Close 13837
Close 13838
Close 13847
Close 13852
Close 13849
Close 13850
Close 13851
Close 13853
Close 13842
Close 13845
Close 13846
Close 13843
Close 13844
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13880
FIND_FIRST \clients\client1\~dmtmp\*
Close 13880
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13881
ReadX 13881 0 4096 4096
ReadX 13881 4096 4096 4096
ReadX 13881 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13882
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13882 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13883
ReadX 13883 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13884
ReadX 13884 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13885
ReadX 13885 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13886
ReadX 13886 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13887
ReadX 13887 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13888
ReadX 13888 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13889
ReadX 13889 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13890
ReadX 13890 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13891
ReadX 13891 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13892
ReadX 13892 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13893
ReadX 13893 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13894
ReadX 13894 0 4096 4096
ReadX 13882 0 4096 4096
ReadX 13882 0 4096 4096
ReadX 13882 4096 16384 16384
Close 13889
Close 13882
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13895
ReadX 13895 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13896
ReadX 13896 0 4096 4096
ReadX 13895 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13900
FIND_FIRST \clients\client1\~dmtmp\*
Close 13900
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13901
QUERY_FILE_INFORMATION 13901
WriteX 13901 2047 1 1
QUERY_FILE_INFORMATION 13901
WriteX 13901 0 2048 2048
Close 13901
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13902
ReadX 13902 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13902 4095 1 1
QUERY_FILE_INFORMATION 13902
ReadX 13902 0 4096 4096
WriteX 13902 0 4096 4096
Close 13902
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13903
ReadX 13903 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13903 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13907
Close 13907
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13908
QUERY_FILE_INFORMATION 13908
WriteX 13908 2047 1 1
QUERY_FILE_INFORMATION 13908
WriteX 13908 0 2048 2048
Close 13908
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13909
ReadX 13909 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13909 4095 1 1
QUERY_FILE_INFORMATION 13909
ReadX 13909 0 4096 4096
WriteX 13909 0 4096 4096
Close 13909
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13910
ReadX 13910 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13910 0 4096 4096
Close 13895
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13911
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13911 0 4096 4096
ReadX 13911 0 4096 4096
ReadX 13911 4096 16384 16384
Close 13911
Close 13903
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13912
QUERY_FILE_INFORMATION 13912
Close 13912
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13881
Close 13893
Close 13888
Close 13894
Close 13896
Close 13883
Close 13886
Close 13887
Close 13884
Close 13885
Close 13890
Close 13891
Close 13892
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13910
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13913
QUERY_FILE_INFORMATION 13913
Close 13913
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13914
ReadX 13914 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13915
Close 13915
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13916
WriteX 13916 63 1 1
QUERY_FILE_INFORMATION 13916
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13914 0 4096 4096
ReadX 13914 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13914 0 8192 8192
Flush 13914
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13914 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13914 0 8192 8192
Flush 13914
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13914 0 8192 8192
Flush 13914
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13914 0 8192 8192
Flush 13914
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13918
Close 13918
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13920
WriteX 13920 4065 1 1
QUERY_FILE_INFORMATION 13920
WriteX 13920 0 62591 62591
Close 13920
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13922
Close 13922
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13924
WriteX 13924 4094 1 1
QUERY_FILE_INFORMATION 13924
WriteX 13924 0 10845 10845
Close 13924
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13926
Close 13926
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13928
WriteX 13928 4081 1 1
QUERY_FILE_INFORMATION 13928
WriteX 13928 0 30118 30118
Close 13928
WriteX 13914 0 4096 4096
Close 13914
WriteX 13916 0 64 64
Close 13916
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13929
ReadX 13929 61440 4096 4096
ReadX 13929 126976 4096 4096
WriteX 13929 0 65471 65471
WriteX 13929 65471 65 65
WriteX 13929 65536 65471 65471
WriteX 13929 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13930
ReadX 13930 61440 4096 4096
ReadX 13930 126976 4096 4096
ReadX 13930 192512 4096 4096
ReadX 13930 258048 4096 4096
WriteX 13930 0 65471 65471
WriteX 13930 65471 65 65
WriteX 13930 65536 65471 65471
WriteX 13930 131007 65 65
WriteX 13930 131072 65471 65471
WriteX 13930 196543 65 65
WriteX 13930 196608 65471 65471
WriteX 13930 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13931
ReadX 13931 61440 4096 4096
ReadX 13931 126976 4096 4096
ReadX 13931 192512 4096 4096
ReadX 13931 258048 4096 4096
ReadX 13931 323584 4096 4096
ReadX 13931 389120 4096 4096
ReadX 13931 454656 4096 4096
ReadX 13931 520192 4096 4096
WriteX 13931 0 65471 65471
WriteX 13931 65471 65 65
WriteX 13931 65536 65471 65471
WriteX 13931 131007 65 65
WriteX 13931 131072 65471 65471
WriteX 13931 196543 65 65
WriteX 13931 196608 65471 65471
WriteX 13931 262079 65 65
WriteX 13931 262144 65471 65471
WriteX 13931 327615 65 65
WriteX 13931 327680 65471 65471
WriteX 13931 393151 65 65
WriteX 13931 393216 65471 65471
WriteX 13931 458687 65 65
WriteX 13931 458752 65471 65471
WriteX 13931 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13932
Close 13932
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13929
Close 13930
Close 13931
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13933
ReadX 13933 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13934
ReadX 13934 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13935
ReadX 13935 0 4096 4096
ReadX 13935 4096 4096 4096
ReadX 13935 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13936
Close 13936
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13933
Close 13934
Close 13935
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13937
Close 13937
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13938
ReadX 13938 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13939
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13939
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13940
Close 13940
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13941
ReadX 13941 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13942
Close 13942
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13938
Close 13941
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13943
Close 13943
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13944
ReadX 13944 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13945
ReadX 13945 0 8192 8192
ReadX 13945 8192 8192 8192
ReadX 13945 16384 8192 8192
ReadX 13945 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13947
Close 13947
Close 13944
Close 13945
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13949
WriteX 13949 8191 1 1
QUERY_FILE_INFORMATION 13949
WriteX 13949 0 10438 10438
Close 13949
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13950
Close 13950
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13951
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13952
Close 13952
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13953
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13954
Close 13954
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13955
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13956
FIND_FIRST \clients\client1\~dmtmp\*
Close 13956
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13957
Close 13957
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13958
ReadX 13958 0 4096 4096
Close 13958
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13959
ReadX 13959 0 8192 8192
Close 13959
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13960
ReadX 13960 0 8192 8192
ReadX 13960 8192 4096 4096
ReadX 13960 12288 8192 8192
ReadX 13960 20480 8192 8192
ReadX 13960 28672 8192 8192
ReadX 13960 36864 8192 8192
ReadX 13960 45056 8192 8192
ReadX 13960 53248 8192 8192
ReadX 13960 61440 8192 8192
ReadX 13960 69632 8192 8192
ReadX 13960 77824 8192 8192
ReadX 13960 86016 8192 8192
ReadX 13960 94208 8192 8192
ReadX 13960 102400 8192 8192
ReadX 13960 110592 8192 8192
ReadX 13960 118784 8192 8192
ReadX 13960 126976 8192 8192
ReadX 13960 135168 8192 8192
ReadX 13960 143360 8192 8192
ReadX 13960 151552 8192 8192
ReadX 13960 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13961
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13961
Close 13960
Close 13951
Close 13953
Close 13955
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13962
Close 13962
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13964
WriteX 13964 8191 1 1
QUERY_FILE_INFORMATION 13964
WriteX 13964 0 28489 28489
Close 13964
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13965
Close 13965
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13966
FIND_FIRST \clients\client1\~dmtmp\*
Close 13966
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13967
Close 13967
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13968
ReadX 13968 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13969
Close 13969
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13968
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13970
Close 13970
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13971
ReadX 13971 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13972
ReadX 13972 0 8192 8192
ReadX 13972 8192 8192 8192
ReadX 13972 16384 8192 8192
ReadX 13972 24576 8192 8192
ReadX 13972 32768 16384 16384
ReadX 13972 49152 8192 8192
ReadX 13972 57344 8192 8192
ReadX 13972 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13974
Close 13974
Close 13971
Close 13972
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13976
WriteX 13976 8191 1 1
QUERY_FILE_INFORMATION 13976
WriteX 13976 0 29253 29253
Close 13976
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13977
Close 13977
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13978
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13979
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13979
Close 13978
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13980
Close 13980
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13982
WriteX 13982 8191 1 1
QUERY_FILE_INFORMATION 13982
WriteX 13982 0 30183 30183
Close 13982
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13983
Close 13983
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13984
WriteX 13984 0 510 510
WriteX 13984 510 512 512
WriteX 13984 1022 510 510
WriteX 13984 1532 510 510
WriteX 13984 2042 168 168
Close 13984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13985
Close 13985
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13986
ReadX 13986 0 4096 4096
WriteX 13986 0 4096 4096
Close 13986
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13987
ReadX 13987 0 65471 65471
ReadX 13987 65471 65 65
ReadX 13987 65536 65471 65471
ReadX 13987 131007 65 65
ReadX 13987 131072 65471 65471
ReadX 13987 196543 65 65
ReadX 13987 196608 65471 65471
ReadX 13987 262079 65 65
ReadX 13987 262144 65471 65471
ReadX 13987 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13988
ReadX 13988 0 65471 65471
ReadX 13988 65471 65 65
ReadX 13988 65536 65471 65471
ReadX 13988 131007 65 65
ReadX 13988 131072 65471 65471
ReadX 13988 196543 65 65
ReadX 13988 196608 65471 65471
ReadX 13988 262079 65 65
ReadX 13988 262144 65471 65471
ReadX 13988 327615 65 65
ReadX 13988 327680 65471 65471
ReadX 13988 393151 65 65
ReadX 13988 393216 65471 65471
ReadX 13988 458687 65 65
ReadX 13988 458752 65471 65471
ReadX 13988 524223 65 65
ReadX 13988 524288 65471 65471
ReadX 13988 589759 65 65
ReadX 13988 589824 65471 65471
ReadX 13988 655295 65 65
ReadX 13988 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13989
ReadX 13989 0 65471 65471
ReadX 13989 65471 65 65
ReadX 13989 65536 65471 65471
ReadX 13989 131007 65 65
ReadX 13989 131072 65471 65471
ReadX 13989 196543 65 65
ReadX 13989 196608 65471 65471
ReadX 13989 262079 65 65
ReadX 13989 262144 65471 65471
ReadX 13989 327615 65 65
ReadX 13989 327680 65471 65471
ReadX 13989 393151 65 65
ReadX 13989 393216 65471 65471
ReadX 13989 458687 65 65
ReadX 13989 458752 65471 65471
ReadX 13989 524223 65 65
ReadX 13989 524288 65471 65471
ReadX 13989 589759 65 65
ReadX 13989 589824 65471 65471
ReadX 13989 655295 65 65
ReadX 13989 655360 65471 65471
ReadX 13989 720831 65 65
ReadX 13989 720896 65471 65471
ReadX 13989 786367 65 65
ReadX 13989 786432 65471 65471
ReadX 13989 851903 65 65
ReadX 13989 851968 65471 65471
ReadX 13989 917439 65 65
ReadX 13989 917504 65471 65471
ReadX 13989 982975 65 65
ReadX 13989 983040 65471 65471
ReadX 13989 1048511 65 65
ReadX 13989 1048576 65471 65471
ReadX 13989 1114047 65 65
ReadX 13989 1114112 65471 65471
ReadX 13989 1179583 65 65
ReadX 13989 1179648 65471 65471
ReadX 13989 1245119 65 65
ReadX 13989 1245184 65471 65471
ReadX 13989 1310655 65 65
ReadX 13989 1310720 65471 65471
ReadX 13989 1376191 65 65
ReadX 13989 1376256 65471 65471
ReadX 13989 1441727 65 65
ReadX 13989 1441792 65471 65471
ReadX 13989 1507263 65 65
ReadX 13989 1507328 65471 65471
ReadX 13989 1572799 65 65
ReadX 13989 1572864 65471 65471
ReadX 13989 1638335 65 65
ReadX 13989 1638400 65471 65471
ReadX 13989 1703871 65 65
ReadX 13989 1703936 65471 65471
ReadX 13989 1769407 65 65
ReadX 13989 1769472 65471 65471
ReadX 13989 1834943 65 65
ReadX 13989 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13990
ReadX 13990 0 4096 4096
ReadX 13990 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13991
WriteX 13991 52 1 1
QUERY_FILE_INFORMATION 13991
WriteX 13991 0 53 53
Close 13991
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13992
Close 13992
Close 13987
Close 13988
Close 13989
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13990 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13990 0 4096 4096
ReadX 13990 4096 4096 4096
ReadX 13990 8192 4096 4096
ReadX 13990 12288 4096 4096
WriteX 13993 15359 1 1
QUERY_FILE_INFORMATION 13993
ReadX 13990 16384 4096 4096
ReadX 13990 20480 4096 4096
WriteX 13993 0 15360 15360
Close 13993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13994
ReadX 13994 0 4096 4096
WriteX 13994 0 4096 4096
Close 13994
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13995
Close 13995
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13996
ReadX 13996 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13997
Close 13997
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13990
ReadX 13996 0 4096 4096
ReadX 13996 4096 4096 4096
ReadX 13996 8192 4096 4096
ReadX 13996 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13998
ReadX 13998 0 4096 4096
ReadX 13998 0 4096 4096
ReadX 13998 4096 4096 4096
ReadX 13998 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13999
ReadX 13999 0 4096 4096
ReadX 13999 4096 4096 4096
ReadX 13999 8192 4096 4096
Close 13998
Close 13999
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 14000
WriteX 14000 15359 1 1
QUERY_FILE_INFORMATION 14000
WriteX 14000 0 15360 15360
Close 14000
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 14001
ReadX 14001 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13996
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 14002
Close 14002
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 14003
ReadX 14003 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 14004
Close 14004
WriteX 14001 0 4096 4096
Close 14001
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 14005
Close 14005
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 14006
ReadX 14006 0 4096 4096
ReadX 14006 0 4096 4096
ReadX 14006 4096 4096 4096
ReadX 14006 8192 4096 4096
ReadX 14006 12288 3072 3072
ReadX 14006 0 8192 8192
ReadX 14006 8192 4096 4096
ReadX 14006 12288 3072 3072
WriteX 14006 15469 1 1
QUERY_FILE_INFORMATION 14006
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
WriteX 14006 0 19054 19054
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 14007
ReadX 14007 0 4096 4096
ReadX 14007 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 14008
WriteX 14008 52 1 1
QUERY_FILE_INFORMATION 14008
WriteX 14008 0 53 53
Close 14008
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 14009
Close 14009
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 14010
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 14007 0 8192 8192
ReadX 14007 8192 4096 4096
ReadX 14007 12288 4096 4096
WriteX 14010 12005 1 1
QUERY_FILE_INFORMATION 14010
WriteX 14010 0 12006 12006
Close 14010
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 14011
ReadX 14011 0 4096 4096
WriteX 14011 0 4096 4096
Close 14011
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 14012
Close 14012
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 14013
ReadX 14013 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 14014
Close 14014
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 14007
ReadX 14013 0 4096 4096
ReadX 14013 4096 4096 4096
ReadX 14013 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 14015
WriteX 14015 11990 1 1
QUERY_FILE_INFORMATION 14015
WriteX 14015 0 11991 11991
Close 14015
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 14016
ReadX 14016 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 14013
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 14017
Close 14017
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 14018
ReadX 14018 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 14019
Close 14019
WriteX 14016 0 4096 4096
Close 14016
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 14020
Close 14020
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 14021
ReadX 14021 0 4096 4096
ReadX 14021 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 14022
Close 14022
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 14021 0 8192 8192
ReadX 14021 8192 3799 3799
WriteX 14021 13247 1 1
QUERY_FILE_INFORMATION 14021
WriteX 14021 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 14021 0 8192 8192
ReadX 14021 8192 4096 4096
Close 14003
Close 14006
WriteX 14021 0 12288 12288
Close 14021
Close 14018
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 14023
Close 14023
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 14024
Close 14024
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14025
ReadX 14025 61440 4096 4096
ReadX 14025 126976 4096 4096
WriteX 14025 0 65471 65471
WriteX 14025 65471 65 65
WriteX 14025 65536 65471 65471
WriteX 14025 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14026
ReadX 14026 61440 4096 4096
ReadX 14026 126976 4096 4096
ReadX 14026 192512 4096 4096
ReadX 14026 258048 4096 4096
WriteX 14026 0 65471 65471
WriteX 14026 65471 65 65
WriteX 14026 65536 65471 65471
WriteX 14026 131007 65 65
WriteX 14026 131072 65471 65471
WriteX 14026 196543 65 65
WriteX 14026 196608 65471 65471
WriteX 14026 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14027
ReadX 14027 61440 4096 4096
ReadX 14027 126976 4096 4096
ReadX 14027 192512 4096 4096
ReadX 14027 258048 4096 4096
ReadX 14027 323584 4096 4096
ReadX 14027 389120 4096 4096
ReadX 14027 454656 4096 4096
ReadX 14027 520192 4096 4096
WriteX 14027 0 65471 65471
WriteX 14027 65471 65 65
WriteX 14027 65536 65471 65471
WriteX 14027 131007 65 65
WriteX 14027 131072 65471 65471
WriteX 14027 196543 65 65
WriteX 14027 196608 65471 65471
WriteX 14027 262079 65 65
WriteX 14027 262144 65471 65471
WriteX 14027 327615 65 65
WriteX 14027 327680 65471 65471
WriteX 14027 393151 65 65
WriteX 14027 393216 65471 65471
WriteX 14027 458687 65 65
WriteX 14027 458752 65471 65471
WriteX 14027 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 14028
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14028 0 4096 4096
Close 14028
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 14029
ReadX 14029 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14029
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 14030
ReadX 14030 0 4096 4096
ReadX 14030 4096 4096 4096
ReadX 14030 8192 4096 4096
ReadX 14030 12288 4096 4096
ReadX 14030 16384 4096 4096
ReadX 14030 20480 4096 4096
ReadX 14030 24576 4096 4096
ReadX 14030 28672 4096 4096
ReadX 14030 32768 4096 4096
ReadX 14030 36864 4096 4096
ReadX 14030 40960 4096 4096
ReadX 14030 45056 4096 4096
ReadX 14030 49152 4096 4096
ReadX 14030 53248 4096 4096
ReadX 14030 57344 4096 4096
ReadX 14030 61440 4096 4096
ReadX 14030 65536 4096 4096
ReadX 14030 69632 4096 4096
ReadX 14030 73728 4096 4096
WriteX 14030 0 4096 4096
Close 14030
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 14031
Close 14031
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 14032
ReadX 14032 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 14033
Close 14033
Close 14025
Close 14026
Close 14027
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14032
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 14035
WriteX 14035 4607 1 1
QUERY_FILE_INFORMATION 14035
WriteX 14035 0 65471 65471
WriteX 14035 65471 65 65
WriteX 14035 65536 19979 19979
Close 14035
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14036
ReadX 14036 0 4096 4096
WriteX 14036 0 4096 4096
Flush 14036
WriteX 14036 0 4096 4096
Flush 14036
QUERY_FILE_INFORMATION 14036
WriteX 14036 0 4096 4096
Flush 14036
WriteX 14036 0 4096 4096
Flush 14036
WriteX 14036 0 4096 4096
Flush 14036
WriteX 14036 0 4096 4096
Flush 14036
Close 14036
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14037
ReadX 14037 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 14038
ReadX 14038 0 4096 4096
Close 14037
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14039
ReadX 14039 0 4096 4096
Close 14039
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14040
ReadX 14040 0 4096 4096
Close 14040
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14041
ReadX 14041 0 4096 4096
WriteX 14041 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 14042
Close 14042
Close 14038
Close 14041
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 14043
Close 14043
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 14045
WriteX 14045 4607 1 1
QUERY_FILE_INFORMATION 14045
WriteX 14045 0 65471 65471
WriteX 14045 65471 65 65
WriteX 14045 65536 17654 17654
Close 14045
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14046
ReadX 14046 0 4096 4096
WriteX 14046 0 4096 4096
Flush 14046
WriteX 14046 0 4096 4096
Flush 14046
QUERY_FILE_INFORMATION 14046
WriteX 14046 0 4096 4096
Flush 14046
WriteX 14046 0 4096 4096
Flush 14046
WriteX 14046 0 4096 4096
Flush 14046
WriteX 14046 0 4096 4096
Flush 14046
Close 14046
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14047
Close 14047
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14048
ReadX 14048 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 14049
Close 14049
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 14050
ReadX 14050 0 4096 4096
ReadX 14050 4096 4096 4096
ReadX 14050 8192 4096 4096
ReadX 14050 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 14050 16384 4096 4096
ReadX 14050 20480 4096 4096
ReadX 14050 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 14048
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14051
ReadX 14051 0 4096 4096
Close 14051
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14052
ReadX 14052 0 4096 4096
Close 14052
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14053
ReadX 14053 0 4096 4096
WriteX 14053 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 14054
Close 14054
Close 14053
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 14055
Close 14055
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 14057
WriteX 14057 4607 1 1
QUERY_FILE_INFORMATION 14057
WriteX 14057 0 65471 65471
WriteX 14057 65471 65 65
WriteX 14057 65536 19490 19490
Close 14057
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14058
ReadX 14058 0 4096 4096
WriteX 14058 0 4096 4096
Flush 14058
WriteX 14058 0 4096 4096
Flush 14058
QUERY_FILE_INFORMATION 14058
WriteX 14058 0 4096 4096
Flush 14058
WriteX 14058 0 4096 4096
Flush 14058
WriteX 14058 0 4096 4096
Flush 14058
WriteX 14058 0 4096 4096
Flush 14058
Close 14058
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14059
Close 14059
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 14060
ReadX 14060 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 14061
Close 14061
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14060
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14062
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14062 0 4096 4096
Close 14062
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14063
ReadX 14063 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14063
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14064
ReadX 14064 0 4096 4096
ReadX 14064 4096 4096 4096
ReadX 14064 8192 4096 4096
ReadX 14064 12288 4096 4096
ReadX 14064 16384 4096 4096
ReadX 14064 20480 4096 4096
ReadX 14064 24576 4096 4096
ReadX 14064 28672 4096 4096
ReadX 14064 32768 4096 4096
ReadX 14064 36864 4096 4096
ReadX 14064 40960 4096 4096
ReadX 14064 45056 4096 4096
ReadX 14064 49152 4096 4096
ReadX 14064 53248 4096 4096
ReadX 14064 57344 4096 4096
ReadX 14064 61440 4096 4096
ReadX 14064 65536 4096 4096
ReadX 14064 69632 4096 4096
ReadX 14064 73728 4096 4096
WriteX 14064 0 4096 4096
Close 14064
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14065
Close 14065
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 14066
ReadX 14066 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14067
Close 14067
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14066
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14069
WriteX 14069 4607 1 1
QUERY_FILE_INFORMATION 14069
WriteX 14069 0 65471 65471
WriteX 14069 65471 65 65
WriteX 14069 65536 8866 8866
Close 14069
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14070
ReadX 14070 0 4096 4096
WriteX 14070 0 4096 4096
Flush 14070
WriteX 14070 0 4096 4096
Flush 14070
Close 14070
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14071
ReadX 14071 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14071
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14072
ReadX 14072 0 4096 4096
Close 14072
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14073
ReadX 14073 0 4096 4096
Close 14073
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14074
ReadX 14074 0 4096 4096
WriteX 14074 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 14075
Close 14075
Close 14074
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 14076
Close 14076
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14078
WriteX 14078 4607 1 1
QUERY_FILE_INFORMATION 14078
WriteX 14078 0 65471 65471
WriteX 14078 65471 65 65
WriteX 14078 65536 9298 9298
Close 14078
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14079
ReadX 14079 0 4096 4096
WriteX 14079 0 4096 4096
Flush 14079
WriteX 14079 0 4096 4096
Flush 14079
Close 14079
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14080
Close 14080
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14081
ReadX 14081 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 14082
Close 14082
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 14084
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14084 0 4096 4096
Close 14084
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 14085
ReadX 14085 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14085 4096 4096 4096
ReadX 14085 8192 4096 4096
ReadX 14085 12288 4096 4096
ReadX 14085 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 14081
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14086
ReadX 14086 0 4096 4096
Close 14086
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14087
ReadX 14087 0 4096 4096
Close 14087
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14088
ReadX 14088 0 4096 4096
WriteX 14088 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 14089
Close 14089
Close 14085
Close 14088
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 14090
Close 14090
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 14092
WriteX 14092 4607 1 1
QUERY_FILE_INFORMATION 14092
WriteX 14092 0 65471 65471
WriteX 14092 65471 65 65
WriteX 14092 65536 11540 11540
Close 14092
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14093
ReadX 14093 0 4096 4096
WriteX 14093 0 4096 4096
Flush 14093
WriteX 14093 0 4096 4096
Flush 14093
Close 14093
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14094
Close 14094
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 14095
ReadX 14095 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 12439
Close 12439
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 14095
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12440
ReadX 12440 0 65471 65471
ReadX 12440 65471 65 65
ReadX 12440 65536 65471 65471
ReadX 12440 131007 65 65
ReadX 12440 131072 65471 65471
ReadX 12440 196543 65 65
ReadX 12440 196608 65471 65471
ReadX 12440 262079 65 65
ReadX 12440 262144 65471 65471
ReadX 12440 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12441
ReadX 12441 0 65471 65471
ReadX 12441 65471 65 65
ReadX 12441 65536 65471 65471
ReadX 12441 131007 65 65
ReadX 12441 131072 65471 65471
ReadX 12441 196543 65 65
ReadX 12441 196608 65471 65471
ReadX 12441 262079 65 65
ReadX 12441 262144 65471 65471
ReadX 12441 327615 65 65
ReadX 12441 327680 65471 65471
ReadX 12441 393151 65 65
ReadX 12441 393216 65471 65471
ReadX 12441 458687 65 65
ReadX 12441 458752 65471 65471
ReadX 12441 524223 65 65
ReadX 12441 524288 65471 65471
ReadX 12441 589759 65 65
ReadX 12441 589824 65471 65471
ReadX 12441 655295 65 65
ReadX 12441 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12442
ReadX 12442 0 65471 65471
ReadX 12442 65471 65 65
ReadX 12442 65536 65471 65471
ReadX 12442 131007 65 65
Close 14050
ReadX 12442 131072 65471 65471
ReadX 12442 196543 65 65
Close 12440
ReadX 12442 196608 65471 65471
Close 12441
ReadX 12442 262079 65 65
ReadX 12442 262144 65471 65471
ReadX 12442 327615 65 65
ReadX 12442 327680 65471 65471
ReadX 12442 393151 65 65
ReadX 12442 393216 65471 65471
ReadX 12442 458687 65 65
ReadX 12442 458752 65471 65471
ReadX 12442 524223 65 65
ReadX 12442 524288 65471 65471
ReadX 12442 589759 65 65
ReadX 12442 589824 65471 65471
ReadX 12442 655295 65 65
ReadX 12442 655360 65471 65471
ReadX 12442 720831 65 65
ReadX 12442 720896 65471 65471
ReadX 12442 786367 65 65
ReadX 12442 786432 65471 65471
ReadX 12442 851903 65 65
ReadX 12442 851968 65471 65471
ReadX 12442 917439 65 65
ReadX 12442 917504 65471 65471
ReadX 12442 982975 65 65
ReadX 12442 983040 65471 65471
ReadX 12442 1048511 65 65
ReadX 12442 1048576 65471 65471
ReadX 12442 1114047 65 65
ReadX 12442 1114112 65471 65471
ReadX 12442 1179583 65 65
ReadX 12442 1179648 65471 65471
ReadX 12442 1245119 65 65
ReadX 12442 1245184 65471 65471
ReadX 12442 1310655 65 65
ReadX 12442 1310720 65471 65471
ReadX 12442 1376191 65 65
ReadX 12442 1376256 65471 65471
ReadX 12442 1441727 65 65
ReadX 12442 1441792 65471 65471
ReadX 12442 1507263 65 65
ReadX 12442 1507328 65471 65471
ReadX 12442 1572799 65 65
ReadX 12442 1572864 65471 65471
ReadX 12442 1638335 65 65
ReadX 12442 1638400 65471 65471
ReadX 12442 1703871 65 65
ReadX 12442 1703936 65471 65471
ReadX 12442 1769407 65 65
ReadX 12442 1769472 65471 65471
ReadX 12442 1834943 65 65
ReadX 12442 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12443
FIND_FIRST \clients\client1\~dmtmp\*
Close 12443
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12444
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12445
QUERY_FILE_INFORMATION 12445
QUERY_FILE_INFORMATION 12445
QUERY_FILE_INFORMATION 12445
ReadX 12445 2156 24 24
ReadX 12445 2139 276 276
ReadX 12445 2136 14 14
ReadX 12445 2136 7 7
ReadX 12445 2138 12 12
ReadX 12445 2137 8 8
ReadX 12445 2135 15 15
ReadX 12445 0 16 16
ReadX 12445 16 2048 2048
ReadX 12445 2064 2048 2048
ReadX 12445 257 2048 2048
ReadX 12445 385 2048 2048
ReadX 12445 513 2048 2048
ReadX 12445 641 2048 2048
ReadX 12445 769 2048 2048
ReadX 12445 897 2048 2048
ReadX 12445 1025 2048 2048
ReadX 12445 1153 2048 2048
ReadX 12445 1281 2048 2048
ReadX 12445 1409 2048 2048
ReadX 12445 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12447
Close 12447
Close 12442
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12449
WriteX 12449 15 1 1
QUERY_FILE_INFORMATION 12449
WriteX 12449 0 10575 10575
Flush 12449
Close 12449
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12450
Close 12450
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12451
ReadX 12451 0 4096 4096
Close 12445
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12452
Close 12452
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12453
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12454
QUERY_FILE_INFORMATION 12454
ReadX 12454 0 512 512
ReadX 12454 512 512 512
ReadX 12454 1024 512 512
QUERY_FILE_INFORMATION 12454
QUERY_FILE_INFORMATION 12454
Close 12454
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12455
QUERY_FILE_INFORMATION 12455
ReadX 12455 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12456
QUERY_FILE_INFORMATION 12456
ReadX 12456 0 512 512
ReadX 12456 512 512 512
ReadX 12456 1024 512 512
ReadX 12456 288 20 20
ReadX 12456 308 2084 2084
ReadX 12456 388 2084 2084
ReadX 12456 388 2084 2084
ReadX 12444 2157 1386 1386
ReadX 12456 2472 399 399
ReadX 12456 3072 1536 1536
ReadX 12456 544 149 149
ReadX 12456 693 485 485
Close 12456
ReadX 12444 2157 4096 4096
ReadX 12444 6253 4096 4096
ReadX 12444 10349 4096 4096
ReadX 12444 14445 4096 4096
ReadX 12444 18541 4096 4096
ReadX 12444 22637 256 256
ReadX 12444 22893 4096 4096
ReadX 12444 26989 4096 4096
ReadX 12444 31085 4096 4096
ReadX 12444 35181 4096 4096
ReadX 12444 39277 4096 4096
ReadX 12444 43373 4096 4096
ReadX 12444 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12444 2157 1024 1024
ReadX 12444 1667 4688 4688
ReadX 12444 6355 3516 3516
ReadX 12444 9871 16384 16384
ReadX 12444 26255 3771 3771
ReadX 12444 30026 2048 2048
ReadX 12444 32074 1024 1024
ReadX 12444 33098 6652 6652
ReadX 12444 39750 16384 16384
ReadX 12444 56134 10496 10496
ReadX 12444 66630 1784 1784
ReadX 12444 68414 90 90
ReadX 12444 68504 273 273
ReadX 12444 68777 1600 1600
ReadX 12444 70377 640 640
ReadX 12444 71017 1280 1280
ReadX 12444 72297 8464 8464
ReadX 12444 80761 158 158
ReadX 12444 80919 912 912
ReadX 12444 81831 1980 1980
ReadX 12444 83811 2256 2256
ReadX 12444 86067 400 400
ReadX 12444 86467 252 252
ReadX 12444 86719 42 42
ReadX 12444 86761 725 725
ReadX 12444 2009 512 512
ReadX 12444 3895 9 9
ReadX 12444 3781 46 46
ReadX 12444 4059 92 92
ReadX 12444 3781 92 92
ReadX 12444 3986 184 184
ReadX 12444 3987 16384 16384
ReadX 12444 3902 16384 16384
ReadX 12444 3781 10240 10240
ReadX 12444 3821 16384 16384
ReadX 12444 3891 935 935
ReadX 12444 4060 10240 10240
ReadX 12444 4059 184 184
ReadX 12444 256 184 184
ReadX 12444 256 1026 1026
ReadX 12444 3901 326 326
ReadX 12444 3899 652 652
ReadX 12444 256 2 2
ReadX 12444 258 4948 4948
Close 12444
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12458
Close 12458
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12460
WriteX 12460 4055 1 1
QUERY_FILE_INFORMATION 12460
WriteX 12460 0 65471 65471
WriteX 12460 65471 65 65
WriteX 12460 65536 65471 65471
WriteX 12460 131007 65 65
WriteX 12460 131072 65471 65471
WriteX 12460 196543 65 65
WriteX 12460 196608 65471 65471
WriteX 12460 262079 65 65
WriteX 12460 262144 65471 65471
WriteX 12460 327615 65 65
WriteX 12460 327680 65471 65471
WriteX 12460 393151 65 65
WriteX 12460 393216 65471 65471
WriteX 12460 458687 65 65
WriteX 12460 458752 65471 65471
WriteX 12460 524223 65 65
WriteX 12460 524288 65471 65471
WriteX 12460 589759 65 65
WriteX 12460 589824 35257 35257
Close 12460
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12462
Close 12462
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12464
WriteX 12464 4055 1 1
QUERY_FILE_INFORMATION 12464
WriteX 12464 0 65471 65471
WriteX 12464 65471 65 65
WriteX 12464 65536 65471 65471
WriteX 12464 131007 65 65
WriteX 12464 131072 65471 65471
WriteX 12464 196543 65 65
WriteX 12464 196608 65471 65471
WriteX 12464 262079 65 65
WriteX 12464 262144 65471 65471
WriteX 12464 327615 65 65
WriteX 12464 327680 65471 65471
WriteX 12464 393151 65 65
WriteX 12464 393216 65471 65471
WriteX 12464 458687 65 65
WriteX 12464 458752 65471 65471
WriteX 12464 524223 65 65
WriteX 12464 524288 65471 65471
WriteX 12464 589759 65 65
WriteX 12464 589824 57598 57598
Close 12464
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12466
WriteX 12466 15 1 1
QUERY_FILE_INFORMATION 12466
WriteX 12466 0 12543 12543
Flush 12466
Close 12466
Close 12451
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12467
Close 12467
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12468
ReadX 12468 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12469
FIND_FIRST \clients\client1\~dmtmp\*
Close 12469
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12470
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12471
QUERY_FILE_INFORMATION 12471
QUERY_FILE_INFORMATION 12471
QUERY_FILE_INFORMATION 12471
ReadX 12471 1938 24 24
ReadX 12471 1920 276 276
ReadX 12471 1918 14 14
ReadX 12471 1918 7 7
ReadX 12471 1919 12 12
ReadX 12471 1919 8 8
ReadX 12471 1917 15 15
ReadX 12471 0 16 16
ReadX 12471 16 2048 2048
ReadX 12471 2064 2048 2048
ReadX 12471 257 2048 2048
ReadX 12471 385 2048 2048
ReadX 12471 513 2048 2048
ReadX 12471 641 2048 2048
ReadX 12471 769 2048 2048
ReadX 12471 897 2048 2048
ReadX 12471 1025 2048 2048
ReadX 12471 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12473
Close 12473
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12475
WriteX 12475 15 1 1
QUERY_FILE_INFORMATION 12475
WriteX 12475 0 11588 11588
Flush 12475
Close 12475
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12476
Close 12476
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12477
ReadX 12477 0 4096 4096
Close 12471
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12479
WriteX 12479 15 1 1
QUERY_FILE_INFORMATION 12479
WriteX 12479 0 11615 11615
Flush 12479
Close 12479
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12477
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12480
Close 12480
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12481
ReadX 12481 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12483
Close 12483
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12485
WriteX 12485 4088 1 1
QUERY_FILE_INFORMATION 12485
WriteX 12485 0 65471 65471
WriteX 12485 65471 65 65
WriteX 12485 65536 16050 16050
Close 12485
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12470 1939 64 64
ReadX 12470 128 248 248
ReadX 12470 128 568 568
ReadX 12470 3872 1536 1536
ReadX 12470 3456 2560 2560
ReadX 12470 3136 512 512
ReadX 12470 2880 4096 4096
ReadX 12470 3264 3072 3072
ReadX 12470 320 4096 4096
ReadX 12470 1024 4096 4096
ReadX 12470 3616 4096 4096
ReadX 12470 1939 64 64
ReadX 12470 128 248 248
ReadX 12470 128 608 608
ReadX 12470 2858 1024 1024
ReadX 12470 2810 4096 4096
ReadX 12470 2826 4096 4096
ReadX 12470 2580 2048 2048
ReadX 12470 2800 2560 2560
ReadX 12470 2100 4096 4096
ReadX 12470 2084 4096 4096
ReadX 12470 868 4096 4096
ReadX 12470 2324 4096 4096
ReadX 12470 884 4096 4096
ReadX 12470 2604 1024 1024
ReadX 12470 580 4096 4096
ReadX 12470 596 4096 4096
ReadX 12470 2752 4096 4096
ReadX 12470 2842 1024 1024
ReadX 12470 660 4096 4096
ReadX 12470 2720 4096 4096
ReadX 12470 2736 4096 4096
ReadX 12470 628 4096 4096
ReadX 12470 2704 4096 4096
ReadX 12470 1556 4096 4096
ReadX 12470 576 4096 4096
ReadX 12470 3168 1536 1536
ReadX 12470 832 4096 4096
ReadX 12470 1088 4096 4096
ReadX 12470 1344 4096 4096
ReadX 12470 1600 4096 4096
ReadX 12470 1856 4096 4096
ReadX 12470 2112 4096 4096
ReadX 12470 1892 4096 4096
ReadX 12470 820 4096 4096
ReadX 12470 788 4096 4096
ReadX 12470 1604 4096 4096
ReadX 12470 3648 4096 4096
ReadX 12470 2608 4096 4096
ReadX 12470 548 4096 4096
ReadX 12470 740 4096 4096
ReadX 12470 1344 4096 4096
ReadX 12470 3392 4096 4096
ReadX 12470 3904 4096 4096
ReadX 12470 644 4096 4096
ReadX 12470 676 4096 4096
ReadX 12470 2688 4096 4096
ReadX 12470 320 4096 4096
ReadX 12470 900 4096 4096
ReadX 12470 1908 4096 4096
ReadX 12470 852 4096 4096
ReadX 12470 724 4096 4096
ReadX 12470 2292 4096 4096
ReadX 12470 612 4096 4096
ReadX 12470 388 4096 4096
ReadX 12470 2368 4096 4096
ReadX 12470 2624 4096 4096
ReadX 12470 500 4096 4096
ReadX 12470 356 4096 4096
ReadX 12470 1024 4096 4096
ReadX 12470 576 4096 4096
ReadX 12470 340 4096 4096
ReadX 12470 420 4096 4096
ReadX 12470 1600 4096 4096
ReadX 12470 404 4096 4096
ReadX 12470 1428 4096 4096
ReadX 12470 2656 4096 4096
ReadX 12470 2624 4096 4096
ReadX 12470 452 4096 4096
ReadX 12470 692 4096 4096
ReadX 12470 564 4096 4096
ReadX 12470 372 4096 4096
ReadX 12470 468 4096 4096
ReadX 12470 484 4096 4096
ReadX 12470 1088 4096 4096
ReadX 12470 1924 4096 4096
ReadX 12470 2768 4096 4096
ReadX 12470 832 4096 4096
ReadX 12470 836 4096 4096
ReadX 12470 1856 4096 4096
ReadX 12470 2640 4096 4096
ReadX 12470 436 4096 4096
ReadX 12470 1828 4096 4096
ReadX 12470 804 4096 4096
ReadX 12470 1860 4096 4096
ReadX 12470 1812 4096 4096
ReadX 12470 756 4096 4096
ReadX 12470 1636 4096 4096
ReadX 12470 772 4096 4096
ReadX 12470 2036 4096 4096
ReadX 12470 1220 4096 4096
ReadX 12470 1652 4096 4096
ReadX 12470 2588 4096 4096
ReadX 12470 916 4096 4096
ReadX 12470 260 4096 4096
ReadX 12470 932 4096 4096
ReadX 12470 2624 4096 4096
ReadX 12470 308 4096 4096
ReadX 12470 292 4096 4096
ReadX 12470 1140 4096 4096
ReadX 12470 276 4096 4096
ReadX 12470 2020 4096 4096
ReadX 12470 2880 4096 4096
ReadX 12470 516 4096 4096
ReadX 12470 1844 4096 4096
ReadX 12470 1124 4096 4096
ReadX 12470 3136 4096 4096
ReadX 12470 324 4096 4096
ReadX 12470 1156 4096 4096
ReadX 12470 1172 4096 4096
ReadX 12470 2112 4096 4096
ReadX 12470 2368 4096 4096
ReadX 12470 964 4096 4096
ReadX 12470 980 4096 4096
ReadX 12470 1012 4096 4096
ReadX 12470 532 4096 4096
ReadX 12470 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12470 1620 4096 4096
ReadX 12470 1604 4096 4096
ReadX 12470 2116 4096 4096
ReadX 12470 2132 4096 4096
ReadX 12470 2148 4096 4096
ReadX 12470 2276 4096 4096
ReadX 12470 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12487
Close 12487
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12489
QUERY_FILE_INFORMATION 12453
Close 12453
WriteX 12489 4088 1 1
QUERY_FILE_INFORMATION 12489
QUERY_FILE_INFORMATION 12455
Close 12455
WriteX 12489 0 65471 65471
WriteX 12489 65471 65 65
WriteX 12489 65536 64850 64850
Close 12489
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12491
WriteX 12491 15 1 1
QUERY_FILE_INFORMATION 12491
ReadX 12470 2068 4096 4096
ReadX 12470 1588 4096 4096
ReadX 12470 1572 4096 4096
WriteX 12491 0 18630 18630
Flush 12491
Close 12491
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12481
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12492
Close 12492
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12493
ReadX 12493 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 12470 612 4096 4096
ReadX 12470 564 4096 4096
ReadX 12470 1876 4096 4096
ReadX 12470 628 4096 4096
ReadX 12470 740 4096 4096
ReadX 12470 724 4096 4096
ReadX 12470 644 4096 4096
ReadX 12470 2324 4096 4096
ReadX 12470 660 4096 4096
ReadX 12470 852 4096 4096
ReadX 12470 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 12470 2368 4096 4096
ReadX 12470 1024 4096 4096
ReadX 12470 320 4096 4096
ReadX 12470 580 4096 4096
ReadX 12470 3136 512 512
ReadX 12470 2880 4096 4096
Close 12470
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12494
ReadX 12494 61440 4096 4096
ReadX 12494 126976 4096 4096
WriteX 12494 0 65471 65471
WriteX 12494 65471 65 65
WriteX 12494 65536 65471 65471
WriteX 12494 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12495
ReadX 12495 61440 4096 4096
ReadX 12495 126976 4096 4096
ReadX 12495 192512 4096 4096
ReadX 12495 258048 4096 4096
WriteX 12495 0 65471 65471
WriteX 12495 65471 65 65
WriteX 12495 65536 65471 65471
WriteX 12495 131007 65 65
WriteX 12495 131072 65471 65471
WriteX 12495 196543 65 65
WriteX 12495 196608 65471 65471
WriteX 12495 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12496
ReadX 12496 61440 4096 4096
ReadX 12496 126976 4096 4096
ReadX 12496 192512 4096 4096
ReadX 12496 258048 4096 4096
ReadX 12496 323584 4096 4096
ReadX 12496 389120 4096 4096
ReadX 12496 454656 4096 4096
ReadX 12496 520192 4096 4096
WriteX 12496 0 65471 65471
WriteX 12496 65471 65 65
WriteX 12496 65536 65471 65471
WriteX 12496 131007 65 65
WriteX 12496 131072 65471 65471
WriteX 12496 196543 65 65
WriteX 12496 196608 65471 65471
WriteX 12496 262079 65 65
WriteX 12496 262144 65471 65471
WriteX 12496 327615 65 65
WriteX 12496 327680 65471 65471
WriteX 12496 393151 65 65
WriteX 12496 393216 65471 65471
WriteX 12496 458687 65 65
WriteX 12496 458752 65471 65471
WriteX 12496 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12497
Close 12497
Close 12493
Close 12468
Close 12494
Close 12495
Close 12496
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12498
Close 12498
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 12501
Close 12501
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 12503
Close 12503
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 12504
Close 12504
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12507
Close 12507
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12509
Close 12509
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12510
Close 12510
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12513
Close 12513
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12517
Close 12517
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12521
Close 12521
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12525
Close 12525
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12529
Close 12529
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12533
Close 12533
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12537
Close 12537
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12541
Close 12541
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12543
Close 12543
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12545
Close 12545
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12547
WriteX 12547 4095 1 1
QUERY_FILE_INFORMATION 12547
QUERY_FS_INFORMATION 259
WriteX 12547 0 65471 65471
WriteX 12547 65471 65 65
WriteX 12547 65536 65471 65471
WriteX 12547 131007 65 65
WriteX 12547 131072 65471 65471
WriteX 12547 196543 65 65
WriteX 12547 196608 65471 65471
WriteX 12547 262079 65 65
WriteX 12547 262144 26634 26634
Close 12547
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12552
Close 12552
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12553
Close 12553
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12554
ReadX 12554 0 4096 4096
Close 12554
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12555
ReadX 12555 0 4096 4096
ReadX 12555 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12556
Close 12556
Close 12555
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12559
Close 12559
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12561
Close 12561
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12562
Close 12562
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12565
Close 12565
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12567
Close 12567
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12568
Close 12568
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12571
Close 12571
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12575
Close 12575
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12579
Close 12579
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12583
Close 12583
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12587
Close 12587
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12591
Close 12591
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12594
Close 12594
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12598
Close 12598
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12602
Close 12602
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 12604
Close 12604
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 12605
Close 12605
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12614
Close 12614
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12615
FIND_FIRST \clients\client1\~dmtmp\*
Close 12615
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12616
Close 12616
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12617
ReadX 12617 0 4096 4096
Close 12617
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12618
ReadX 12618 0 4096 4096
Close 12618
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12619
ReadX 12619 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12629
Close 12629
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12630
FIND_FIRST \clients\client1\~dmtmp\*
Close 12630
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12631
Close 12631
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12632
ReadX 12632 0 4096 4096
Close 12632
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12633
ReadX 12633 0 4096 4096
Close 12633
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12634
ReadX 12634 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12635
ReadX 12635 0 65471 65471
ReadX 12635 65471 65 65
ReadX 12635 65536 65471 65471
ReadX 12635 131007 65 65
ReadX 12635 131072 65471 65471
ReadX 12635 196543 65 65
ReadX 12635 196608 65471 65471
ReadX 12635 262079 65 65
ReadX 12635 262144 65471 65471
ReadX 12635 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12636
ReadX 12636 0 65471 65471
ReadX 12636 65471 65 65
ReadX 12636 65536 65471 65471
ReadX 12636 131007 65 65
ReadX 12636 131072 65471 65471
ReadX 12636 196543 65 65
ReadX 12636 196608 65471 65471
ReadX 12636 262079 65 65
ReadX 12636 262144 65471 65471
ReadX 12636 327615 65 65
ReadX 12636 327680 65471 65471
ReadX 12636 393151 65 65
ReadX 12636 393216 65471 65471
ReadX 12636 458687 65 65
ReadX 12636 458752 65471 65471
ReadX 12636 524223 65 65
ReadX 12636 524288 65471 65471
ReadX 12636 589759 65 65
ReadX 12636 589824 65471 65471
ReadX 12636 655295 65 65
ReadX 12636 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12637
ReadX 12637 0 65471 65471
ReadX 12637 65471 65 65
ReadX 12637 65536 65471 65471
ReadX 12637 131007 65 65
ReadX 12637 131072 65471 65471
ReadX 12637 196543 65 65
ReadX 12637 196608 65471 65471
ReadX 12637 262079 65 65
ReadX 12637 262144 65471 65471
ReadX 12637 327615 65 65
ReadX 12637 327680 65471 65471
ReadX 12637 393151 65 65
ReadX 12637 393216 65471 65471
Close 12619
ReadX 12637 458687 65 65
ReadX 12637 458752 65471 65471
Close 12634
ReadX 12637 524223 65 65
ReadX 12637 524288 65471 65471
Close 12635
ReadX 12637 589759 65 65
ReadX 12637 589824 65471 65471
Close 12636
ReadX 12637 655295 65 65
ReadX 12637 655360 65471 65471
ReadX 12637 720831 65 65
ReadX 12637 720896 65471 65471
ReadX 12637 786367 65 65
ReadX 12637 786432 65471 65471
ReadX 12637 851903 65 65
ReadX 12637 851968 65471 65471
ReadX 12637 917439 65 65
ReadX 12637 917504 65471 65471
ReadX 12637 982975 65 65
ReadX 12637 983040 65471 65471
ReadX 12637 1048511 65 65
ReadX 12637 1048576 65471 65471
ReadX 12637 1114047 65 65
ReadX 12637 1114112 65471 65471
ReadX 12637 1179583 65 65
ReadX 12637 1179648 65471 65471
ReadX 12637 1245119 65 65
ReadX 12637 1245184 65471 65471
ReadX 12637 1310655 65 65
ReadX 12637 1310720 65471 65471
ReadX 12637 1376191 65 65
ReadX 12637 1376256 65471 65471
ReadX 12637 1441727 65 65
ReadX 12637 1441792 65471 65471
ReadX 12637 1507263 65 65
ReadX 12637 1507328 65471 65471
ReadX 12637 1572799 65 65
ReadX 12637 1572864 65471 65471
ReadX 12637 1638335 65 65
ReadX 12637 1638400 65471 65471
ReadX 12637 1703871 65 65
ReadX 12637 1703936 65471 65471
ReadX 12637 1769407 65 65
ReadX 12637 1769472 65471 65471
ReadX 12637 1834943 65 65
ReadX 12637 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12638
ReadX 12638 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12638 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12638 8192 4096 4096
ReadX 12638 12288 4096 4096
ReadX 12638 16384 4096 4096
ReadX 12638 20480 4096 4096
ReadX 12638 24576 4096 4096
ReadX 12638 28672 4096 4096
ReadX 12638 32768 4096 4096
ReadX 12638 36864 4096 4096
ReadX 12638 40960 4096 4096
ReadX 12638 45056 4096 4096
ReadX 12638 49152 4096 4096
ReadX 12638 53248 4096 4096
ReadX 12638 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12638 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 12639
Close 12639
Close 12637
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 12640
WriteX 12640 1535 1 1
QUERY_FILE_INFORMATION 12640
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12638 0 4096 4096
ReadX 12638 4096 4096 4096
QUERY_FILE_INFORMATION 12640
WriteX 12640 0 57088 57088
WriteX 12640 0 4096 4096
Flush 12640
Close 12638
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12641
Close 12641
WriteX 12640 0 4096 4096
Close 12640
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 12642
Close 12642
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12643
ReadX 12643 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12643 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 12644
WriteX 12644 1535 1 1
QUERY_FILE_INFORMATION 12644
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12643 0 4096 4096
QUERY_FILE_INFORMATION 12644
WriteX 12644 0 51456 51456
WriteX 12644 0 4096 4096
Flush 12644
Close 12643
WriteX 12644 0 4096 4096
Close 12644
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 12645
Close 12645
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12646
ReadX 12646 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12646 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12648
Close 12648
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12650
WriteX 12650 4045 1 1
QUERY_FILE_INFORMATION 12650
WriteX 12650 0 53077 53077
Close 12650
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 12651
WriteX 12651 1535 1 1
QUERY_FILE_INFORMATION 12651
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12646 0 4096 4096
QUERY_FILE_INFORMATION 12651
WriteX 12651 0 65471 65471
WriteX 12651 65471 65 65
WriteX 12651 65536 1856 1856
WriteX 12651 0 4096 4096
Flush 12651
Close 12646
WriteX 12651 0 4096 4096
Close 12651
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 12652
Close 12652
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12653
ReadX 12653 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12655
Close 12655
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12657
WriteX 12657 4076 1 1
QUERY_FILE_INFORMATION 12657
WriteX 12657 0 7983 7983
Close 12657
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12659
Close 12659
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12661
WriteX 12661 4095 1 1
QUERY_FILE_INFORMATION 12661
WriteX 12661 0 65471 65471
WriteX 12661 65471 65 65
WriteX 12661 65536 65471 65471
WriteX 12661 131007 65 65
WriteX 12661 131072 65471 65471
WriteX 12661 196543 65 65
WriteX 12661 196608 65471 65471
WriteX 12661 262079 65 65
WriteX 12661 262144 65471 65471
WriteX 12661 327615 65 65
WriteX 12661 327680 65471 65471
WriteX 12661 393151 65 65
WriteX 12661 393216 65471 65471
WriteX 12661 458687 65 65
WriteX 12661 458752 46731 46731
Close 12661
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 12662
WriteX 12662 1535 1 1
QUERY_FILE_INFORMATION 12662
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12653 0 4096 4096
ReadX 12653 4096 4096 4096
QUERY_FILE_INFORMATION 12662
WriteX 12662 0 65471 65471
WriteX 12662 65471 65 65
WriteX 12662 65536 22848 22848
WriteX 12662 0 4096 4096
Flush 12662
Close 12653
WriteX 12662 0 4096 4096
Close 12662
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 12663
Close 12663
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12664
ReadX 12664 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12664 4096 4096 4096
Close 12664
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12665
ReadX 12665 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12665 0 8192 8192
ReadX 12665 8192 4096 4096
ReadX 12665 12288 4096 4096
ReadX 12665 16384 4096 4096
ReadX 12665 20480 4096 4096
ReadX 12665 24576 4096 4096
ReadX 12665 28672 4096 4096
ReadX 12665 32768 4096 4096
ReadX 12665 36864 4096 4096
ReadX 12665 40960 4096 4096
ReadX 12665 45056 4096 4096
ReadX 12665 49152 4096 4096
ReadX 12665 53248 4096 4096
ReadX 12665 57344 4096 4096
ReadX 12665 61440 4096 4096
ReadX 12665 65536 4096 4096
ReadX 12665 69632 4096 4096
ReadX 12665 73728 4096 4096
ReadX 12665 77824 4096 4096
ReadX 12665 81920 4096 4096
ReadX 12665 86016 4096 4096
ReadX 12665 90112 4096 4096
ReadX 12665 94208 4096 4096
ReadX 12665 98304 4096 4096
ReadX 12665 102400 4096 4096
ReadX 12665 106496 4096 4096
ReadX 12665 110592 4096 4096
ReadX 12665 114688 4096 4096
ReadX 12665 118784 4096 4096
ReadX 12665 122880 4096 4096
ReadX 12665 126976 4096 4096
ReadX 12665 131072 4096 4096
ReadX 12665 135168 4096 4096
ReadX 12665 139264 4096 4096
ReadX 12665 143360 4096 4096
ReadX 12665 147456 4096 4096
ReadX 12665 151552 4096 4096
ReadX 12665 155648 4096 4096
ReadX 12665 159744 4096 4096
ReadX 12665 163840 4096 4096
ReadX 12665 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12665 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 12666
Close 12666
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 12667
WriteX 12667 2047 1 1
QUERY_FILE_INFORMATION 12667
Close 12665
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12668
Close 12668
WriteX 12667 0 42388 42388
Close 12667
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 12669
Close 12669
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12670
ReadX 12670 0 4096 4096
ReadX 12670 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 12671
WriteX 12671 2047 1 1
QUERY_FILE_INFORMATION 12671
Close 12670
WriteX 12671 0 42652 42652
Close 12671
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 12672
Close 12672
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12673
ReadX 12673 0 4096 4096
ReadX 12673 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12675
Close 12675
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12677
WriteX 12677 4080 1 1
QUERY_FILE_INFORMATION 12677
WriteX 12677 0 65471 65471
WriteX 12677 65471 65 65
WriteX 12677 65536 49 49
Close 12677
Close 12673
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12678
ReadX 12678 61440 4096 4096
ReadX 12678 126976 4096 4096
WriteX 12678 0 65471 65471
WriteX 12678 65471 65 65
WriteX 12678 65536 65471 65471
WriteX 12678 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12679
ReadX 12679 61440 4096 4096
ReadX 12679 126976 4096 4096
ReadX 12679 192512 4096 4096
ReadX 12679 258048 4096 4096
WriteX 12679 0 65471 65471
WriteX 12679 65471 65 65
WriteX 12679 65536 65471 65471
WriteX 12679 131007 65 65
WriteX 12679 131072 65471 65471
WriteX 12679 196543 65 65
WriteX 12679 196608 65471 65471
WriteX 12679 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12680
ReadX 12680 61440 4096 4096
ReadX 12680 126976 4096 4096
ReadX 12680 192512 4096 4096
ReadX 12680 258048 4096 4096
ReadX 12680 323584 4096 4096
ReadX 12680 389120 4096 4096
ReadX 12680 454656 4096 4096
ReadX 12680 520192 4096 4096
WriteX 12680 0 65471 65471
WriteX 12680 65471 65 65
WriteX 12680 65536 65471 65471
WriteX 12680 131007 65 65
WriteX 12680 131072 65471 65471
WriteX 12680 196543 65 65
WriteX 12680 196608 65471 65471
WriteX 12680 262079 65 65
WriteX 12680 262144 65471 65471
WriteX 12680 327615 65 65
WriteX 12680 327680 65471 65471
WriteX 12680 393151 65 65
WriteX 12680 393216 65471 65471
WriteX 12680 458687 65 65
WriteX 12680 458752 65471 65471
WriteX 12680 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12681
FIND_FIRST \clients\client1\~dmtmp\*
Close 12681
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12682
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12682 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12683
ReadX 12683 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12684
ReadX 12684 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12685
ReadX 12685 0 4096 4096
ReadX 12682 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12682
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12686
ReadX 12686 0 4096 4096
ReadX 12686 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12687
FIND_FIRST \clients\client1\~dmtmp\*
Close 12687
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 12688
QUERY_FILE_INFORMATION 12688
WriteX 12688 2047 1 1
QUERY_FILE_INFORMATION 12688
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 12689
Close 12689
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12690
WriteX 12690 52 1 1
QUERY_FILE_INFORMATION 12690
WriteX 12690 0 491 491
Close 12690
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12691
ReadX 12691 0 491 491
WriteX 12688 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 12686
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12692
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12692 0 4096 4096
ReadX 12692 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 12694
Close 12694
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12695
WriteX 12695 52 1 1
QUERY_FILE_INFORMATION 12695
WriteX 12695 0 543 543
Close 12695
Close 12692
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12696
ReadX 12696 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12697
ReadX 12697 0 543 543
ReadX 12696 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12696
Close 12691
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12678
Close 12679
Close 12680
Close 12697
Close 12683
Close 12684
Close 12685
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12688
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12698
FIND_FIRST \clients\client1\~dmtmp\*
Close 12698
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12699
ReadX 12699 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12700
ReadX 12700 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12701
ReadX 12701 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12702
ReadX 12702 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12703
ReadX 12703 0 543 543
ReadX 12699 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 12707
FIND_FIRST \clients\client1\~dmtmp\*
Close 12707
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12708
QUERY_FILE_INFORMATION 12708
WriteX 12708 2047 1 1
QUERY_FILE_INFORMATION 12708
WriteX 12708 0 2048 2048
Close 12708
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12709
ReadX 12709 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12709
Close 12699
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12710
ReadX 12710 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 12710 4095 1 1
QUERY_FILE_INFORMATION 12710
ReadX 12710 0 4096 4096
WriteX 12710 0 4096 4096
Flush 12710
WriteX 12710 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12711
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12711 0 4096 4096
ReadX 12711 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 12715
FIND_FIRST \clients\client1\~dmtmp\*
Close 12715
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12716
WriteX 12716 2047 1 1
QUERY_FILE_INFORMATION 12716
WriteX 12716 0 2048 2048
Close 12716
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12717
ReadX 12717 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 12721
Close 12721
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12722
WriteX 12722 2047 1 1
QUERY_FILE_INFORMATION 12722
WriteX 12722 0 2048 2048
Close 12722
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12723
ReadX 12723 0 2048 2048
ReadX 12711 4096 16384 16384
Close 12723
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12724
ReadX 12724 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 12724
Close 12703
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 12717 4095 1 1
QUERY_FILE_INFORMATION 12717
ReadX 12717 0 4096 4096
WriteX 12717 0 4096 4096
Close 12717
WriteX 12711 0 8192 8192
Close 12711
WriteX 12700 0 4096 4096
WriteX 12701 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12726
ReadX 12726 0 4096 4096
ReadX 12726 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12726
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12727
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12727 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12728
ReadX 12728 0 543 543
ReadX 12727 0 4096 4096
Close 12727
Close 12710
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12729
QUERY_FILE_INFORMATION 12729
Close 12729
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12728
Close 12700
Close 12701
Close 12702
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12730
FIND_FIRST \clients\client1\~dmtmp\*
Close 12730
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12731
ReadX 12731 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12732
ReadX 12732 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12733
ReadX 12733 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12734
ReadX 12734 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12735
ReadX 12735 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12736
ReadX 12736 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12737
ReadX 12737 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12738
ReadX 12738 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12739
ReadX 12739 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12740
ReadX 12740 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12741
ReadX 12741 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12742
ReadX 12742 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12743
ReadX 12743 0 4096 4096
ReadX 12731 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12747
FIND_FIRST \clients\client1\~dmtmp\*
Close 12747
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12748
QUERY_FILE_INFORMATION 12748
WriteX 12748 2047 1 1
QUERY_FILE_INFORMATION 12748
WriteX 12748 0 2048 2048
Close 12748
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12749
ReadX 12749 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12749
Close 12739
Close 12731
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12750
ReadX 12750 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12751
FIND_FIRST \clients\client1\~dmtmp\*
Close 12751
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12752
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12752 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12753
ReadX 12753 0 4096 4096
ReadX 12752 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12757
FIND_FIRST \clients\client1\~dmtmp\*
Close 12757
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12758
QUERY_FILE_INFORMATION 12758
WriteX 12758 2047 1 1
QUERY_FILE_INFORMATION 12758
WriteX 12758 0 2048 2048
Close 12758
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12759
ReadX 12759 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12759
Close 12752
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12760
ReadX 12760 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12750 4095 1 1
QUERY_FILE_INFORMATION 12750
ReadX 12750 0 4096 4096
WriteX 12750 0 4096 4096
Flush 12750
WriteX 12760 4095 1 1
QUERY_FILE_INFORMATION 12760
ReadX 12760 0 4096 4096
WriteX 12760 0 4096 4096
Flush 12760
WriteX 12750 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 12760 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12761
ReadX 12761 0 4096 4096
ReadX 12753 0 4096 4096
ReadX 12761 0 4096 4096
ReadX 12761 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12762
FIND_FIRST \clients\client1\~dmtmp\*
Close 12762
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12763
WriteX 12763 4095 1 1
QUERY_FILE_INFORMATION 12763
WriteX 12763 0 4096 4096
Close 12763
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12764
ReadX 12764 0 4096 4096
Close 12761
Close 12753
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12765
Close 12765
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12766
WriteX 12766 4095 1 1
QUERY_FILE_INFORMATION 12766
WriteX 12766 0 4096 4096
Close 12766
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12767
ReadX 12767 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 12767 0 4096 4096
Close 12764
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12743
Close 12737
Close 12740
Close 12741
Close 12742
Close 12738
Close 12732
Close 12735
Close 12736
Close 12733
Close 12734
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12767
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12769
Close 12769
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12770
ReadX 12770 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12771
Close 12771
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12772
WriteX 12772 2047 1 1
QUERY_FILE_INFORMATION 12772
WriteX 12772 0 2048 2048
Close 12772
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12773
ReadX 12773 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12773
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12774
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12774 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12775
ReadX 12775 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12776
ReadX 12776 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12777
ReadX 12777 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12778
ReadX 12778 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12779
ReadX 12779 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12780
ReadX 12780 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12781
ReadX 12781 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12782
ReadX 12782 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12783
ReadX 12783 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12784
ReadX 12784 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12785
ReadX 12785 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12786
ReadX 12786 0 4096 4096
ReadX 12774 0 4096 4096
ReadX 12781 0 4096 4096
Close 12781
Close 12774
Close 12750
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12787
QUERY_FILE_INFORMATION 12787
Close 12787
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12770
Close 12785
Close 12780
Close 12782
Close 12783
Close 12784
Close 12786
Close 12775
Close 12778
Close 12779
Close 12776
Close 12777
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12760
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12788
QUERY_FILE_INFORMATION 12788
Close 12788
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12789
FIND_FIRST \clients\client1\~dmtmp\*
Close 12789
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12790
ReadX 12790 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12791
ReadX 12791 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12792
ReadX 12792 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12793
ReadX 12793 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12794
ReadX 12794 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12795
ReadX 12795 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12796
ReadX 12796 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12797
ReadX 12797 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12798
ReadX 12798 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12799
ReadX 12799 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12800
ReadX 12800 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12801
ReadX 12801 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12802
ReadX 12802 0 4096 4096
ReadX 12790 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12806
FIND_FIRST \clients\client1\~dmtmp\*
Close 12806
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12807
QUERY_FILE_INFORMATION 12807
WriteX 12807 2047 1 1
QUERY_FILE_INFORMATION 12807
WriteX 12807 0 2048 2048
Close 12807
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12808
ReadX 12808 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12808
Close 12790
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12809
ReadX 12809 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12810
FIND_FIRST \clients\client1\~dmtmp\*
Close 12810
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12811
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12811 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12812
ReadX 12812 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12813
ReadX 12813 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12814
ReadX 12814 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12815
ReadX 12815 0 543 543
ReadX 12811 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12819
FIND_FIRST \clients\client1\~dmtmp\*
Close 12819
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12820
QUERY_FILE_INFORMATION 12820
WriteX 12820 2047 1 1
QUERY_FILE_INFORMATION 12820
WriteX 12820 0 2048 2048
Close 12820
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12821
ReadX 12821 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12821
Close 12811
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12822
ReadX 12822 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 12795
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12823
FIND_FIRST \clients\client1\~dmtmp\*
Close 12823
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12824
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12824 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12825
ReadX 12825 0 4096 4096
ReadX 12824 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12829
FIND_FIRST \clients\client1\~dmtmp\*
Close 12829
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12830
QUERY_FILE_INFORMATION 12830
WriteX 12830 2047 1 1
QUERY_FILE_INFORMATION 12830
WriteX 12830 0 2048 2048
Close 12830
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12831
ReadX 12831 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12831
Close 12825
Close 12824
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12832
ReadX 12832 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12809 4095 1 1
QUERY_FILE_INFORMATION 12809
ReadX 12809 0 4096 4096
WriteX 12809 0 4096 4096
Flush 12809
WriteX 12822 4095 1 1
QUERY_FILE_INFORMATION 12822
ReadX 12822 0 4096 4096
WriteX 12822 0 4096 4096
Flush 12822
WriteX 12832 4095 1 1
QUERY_FILE_INFORMATION 12832
ReadX 12832 0 4096 4096
WriteX 12832 0 4096 4096
Flush 12832
WriteX 12809 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 12822 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 12832 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12833
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12833 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12834
ReadX 12834 0 4096 4096
ReadX 12833 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12835
ReadX 12835 0 4096 4096
ReadX 12835 0 4096 4096
ReadX 12835 4096 16384 16384
ReadX 12833 4096 16384 16384
ReadX 12833 0 4096 4096
ReadX 12834 0 4096 4096
ReadX 12834 4096 4096 4096
Close 12835
Close 12834
Close 12833
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12836
FIND_FIRST \clients\client1\~dmtmp\*
Close 12836
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12837
ReadX 12837 0 2048 2048
WriteX 12837 18431 1 1
QUERY_FILE_INFORMATION 12837
WriteX 12837 0 19584 19584
Close 12837
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12838
ReadX 12838 0 4096 4096
ReadX 12838 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12838
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12839
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12839 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12840
ReadX 12840 0 4096 4096
ReadX 12839 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12841
ReadX 12841 0 4096 4096
ReadX 12841 0 4096 4096
Close 12841
Close 12840
Close 12839
Close 12809
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12842
QUERY_FILE_INFORMATION 12842
Close 12842
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12815
Close 12802
Close 12794
Close 12812
Close 12813
Close 12814
Close 12801
Close 12796
Close 12799
Close 12800
Close 12797
Close 12798
Close 12791
Close 12792
Close 12793
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12822
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12843
QUERY_FILE_INFORMATION 12843
Close 12843
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12832
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12844
QUERY_FILE_INFORMATION 12844
Close 12844
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12845
FIND_FIRST \clients\client1\~dmtmp\*
Close 12845
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12846
ReadX 12846 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12847
ReadX 12847 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12848
ReadX 12848 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12849
ReadX 12849 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12850
ReadX 12850 0 543 543
ReadX 12846 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12846 4096 16384 16384
WriteX 12846 0 4096 4096
Close 12846
WriteX 12847 0 4096 4096
WriteX 12848 0 4096 4096
WriteX 12849 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12851
FIND_FIRST \clients\client1\~dmtmp\*
Close 12851
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12852
ReadX 12852 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12853
ReadX 12853 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12854
ReadX 12854 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12855
ReadX 12855 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12856
ReadX 12856 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12857
ReadX 12857 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12858
ReadX 12858 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12859
ReadX 12859 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12860
ReadX 12860 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12861
ReadX 12861 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12862
ReadX 12862 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12863
ReadX 12863 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12864
ReadX 12864 0 4096 4096
ReadX 12852 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12865
ReadX 12865 0 8192 8192
ReadX 12852 4096 16384 16384
Close 12859
Close 12852
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12866
FIND_FIRST \clients\client1\~dmtmp\*
Close 12866
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12867
ReadX 12867 0 4096 4096
ReadX 12867 4096 4096 4096
ReadX 12867 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12868
ReadX 12868 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12869
ReadX 12869 0 4096 4096
ReadX 12868 0 4096 4096
ReadX 12868 0 4096 4096
ReadX 12868 4096 16384 16384
Close 12869
WriteX 12868 0 4096 4096
Close 12868
WriteX 12853 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12870
FIND_FIRST \clients\client1\~dmtmp\*
Close 12870
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12871
ReadX 12871 0 4096 4096
ReadX 12871 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12872
ReadX 12872 0 4096 4096
ReadX 12872 0 4096 4096
WriteX 12872 0 4096 4096
Close 12872
WriteX 12847 0 4096 4096
WriteX 12848 0 4096 4096
WriteX 12849 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12873
ReadX 12873 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12874
ReadX 12874 0 4096 4096
ReadX 12873 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12878
FIND_FIRST \clients\client1\~dmtmp\*
Close 12878
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12879
QUERY_FILE_INFORMATION 12879
WriteX 12879 2047 1 1
QUERY_FILE_INFORMATION 12879
WriteX 12879 0 2048 2048
Close 12879
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12880
ReadX 12880 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12880 4095 1 1
QUERY_FILE_INFORMATION 12880
ReadX 12880 0 4096 4096
WriteX 12880 0 4096 4096
Close 12880
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12881
ReadX 12881 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12881 0 4096 4096
Close 12874
Close 12873
WriteX 12881 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12882
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12882 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12883
ReadX 12883 0 4096 4096
ReadX 12882 0 4096 4096
ReadX 12882 4096 16384 16384
Close 12883
Close 12882
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12884
FIND_FIRST \clients\client1\~dmtmp\*
Close 12884
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12885
ReadX 12885 0 4096 4096
ReadX 12885 4096 4096 4096
WriteX 12885 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12885 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12885
ReadX 12881 0 4096 4096
WriteX 12881 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12886
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12886 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12887
ReadX 12887 0 4096 4096
ReadX 12886 0 4096 4096
ReadX 12886 4096 16384 16384
Close 12887
Close 12886
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12888
FIND_FIRST \clients\client1\~dmtmp\*
Close 12888
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12889
ReadX 12889 0 4096 4096
ReadX 12889 4096 4096 4096
WriteX 12889 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12889 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12889
Close 12881
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12890
QUERY_FILE_INFORMATION 12890
Close 12890
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 12865
Close 12867
Close 12871
Close 12850
Close 12847
Close 12848
Close 12849
Close 12858
Close 12863
Close 12860
Close 12861
Close 12862
Close 12864
Close 12853
Close 12856
Close 12857
Close 12854
Close 12855
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12891
FIND_FIRST \clients\client1\~dmtmp\*
Close 12891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12892
ReadX 12892 0 4096 4096
ReadX 12892 4096 4096 4096
ReadX 12892 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12893
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12893 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12894
ReadX 12894 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12895
ReadX 12895 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12896
ReadX 12896 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12897
ReadX 12897 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12898
ReadX 12898 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12899
ReadX 12899 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12900
ReadX 12900 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12901
ReadX 12901 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12902
ReadX 12902 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12903
ReadX 12903 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12904
ReadX 12904 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12905
ReadX 12905 0 4096 4096
ReadX 12893 0 4096 4096
ReadX 12893 0 4096 4096
ReadX 12893 4096 16384 16384
Close 12900
Close 12893
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12906
ReadX 12906 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12907
ReadX 12907 0 4096 4096
ReadX 12906 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12911
FIND_FIRST \clients\client1\~dmtmp\*
Close 12911
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12912
QUERY_FILE_INFORMATION 12912
WriteX 12912 2047 1 1
QUERY_FILE_INFORMATION 12912
WriteX 12912 0 2048 2048
Close 12912
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12913
ReadX 12913 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12913 4095 1 1
QUERY_FILE_INFORMATION 12913
ReadX 12913 0 4096 4096
WriteX 12913 0 4096 4096
Close 12913
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12914
ReadX 12914 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12914 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12918
Close 12918
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12919
QUERY_FILE_INFORMATION 12919
WriteX 12919 2047 1 1
QUERY_FILE_INFORMATION 12919
WriteX 12919 0 2048 2048
Close 12919
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12920
ReadX 12920 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12920 4095 1 1
QUERY_FILE_INFORMATION 12920
ReadX 12920 0 4096 4096
WriteX 12920 0 4096 4096
Close 12920
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12921
ReadX 12921 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12921 0 4096 4096
Close 12906
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12922
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12922 0 4096 4096
ReadX 12922 0 4096 4096
ReadX 12922 4096 16384 16384
Close 12922
Close 12914
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12923
QUERY_FILE_INFORMATION 12923
Close 12923
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12892
Close 12904
Close 12899
Close 12905
Close 12907
Close 12894
Close 12897
Close 12898
Close 12895
Close 12896
Close 12901
Close 12902
Close 12903
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12921
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12924
QUERY_FILE_INFORMATION 12924
Close 12924
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12925
ReadX 12925 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 12926
Close 12926
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 12927
WriteX 12927 63 1 1
QUERY_FILE_INFORMATION 12927
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12925 0 4096 4096
ReadX 12925 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12925 0 8192 8192
Flush 12925
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12925 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12925 0 8192 8192
Flush 12925
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12925 0 8192 8192
Flush 12925
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12925 0 8192 8192
Flush 12925
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12929
Close 12929
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12931
WriteX 12931 4065 1 1
QUERY_FILE_INFORMATION 12931
WriteX 12931 0 62591 62591
Close 12931
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12933
Close 12933
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12935
WriteX 12935 4094 1 1
QUERY_FILE_INFORMATION 12935
WriteX 12935 0 10845 10845
Close 12935
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12937
Close 12937
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12939
WriteX 12939 4081 1 1
QUERY_FILE_INFORMATION 12939
WriteX 12939 0 30118 30118
Close 12939
WriteX 12925 0 4096 4096
Close 12925
WriteX 12927 0 64 64
Close 12927
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12940
ReadX 12940 61440 4096 4096
ReadX 12940 126976 4096 4096
WriteX 12940 0 65471 65471
WriteX 12940 65471 65 65
WriteX 12940 65536 65471 65471
WriteX 12940 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12941
ReadX 12941 61440 4096 4096
ReadX 12941 126976 4096 4096
ReadX 12941 192512 4096 4096
ReadX 12941 258048 4096 4096
WriteX 12941 0 65471 65471
WriteX 12941 65471 65 65
WriteX 12941 65536 65471 65471
WriteX 12941 131007 65 65
WriteX 12941 131072 65471 65471
WriteX 12941 196543 65 65
WriteX 12941 196608 65471 65471
WriteX 12941 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12942
ReadX 12942 61440 4096 4096
ReadX 12942 126976 4096 4096
ReadX 12942 192512 4096 4096
ReadX 12942 258048 4096 4096
ReadX 12942 323584 4096 4096
ReadX 12942 389120 4096 4096
ReadX 12942 454656 4096 4096
ReadX 12942 520192 4096 4096
WriteX 12942 0 65471 65471
WriteX 12942 65471 65 65
WriteX 12942 65536 65471 65471
WriteX 12942 131007 65 65
WriteX 12942 131072 65471 65471
WriteX 12942 196543 65 65
WriteX 12942 196608 65471 65471
WriteX 12942 262079 65 65
WriteX 12942 262144 65471 65471
WriteX 12942 327615 65 65
WriteX 12942 327680 65471 65471
WriteX 12942 393151 65 65
WriteX 12942 393216 65471 65471
WriteX 12942 458687 65 65
WriteX 12942 458752 65471 65471
WriteX 12942 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12943
Close 12943
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12940
Close 12941
Close 12942
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12944
ReadX 12944 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12945
ReadX 12945 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 12946
ReadX 12946 0 4096 4096
ReadX 12946 4096 4096 4096
ReadX 12946 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12947
Close 12947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12944
Close 12945
Close 12946
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12948
Close 12948
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12949
ReadX 12949 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12950
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 12950
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12951
Close 12951
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12952
ReadX 12952 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12953
Close 12953
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12949
Close 12952
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12954
Close 12954
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12955
ReadX 12955 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12956
ReadX 12956 0 8192 8192
ReadX 12956 8192 8192 8192
ReadX 12956 16384 8192 8192
ReadX 12956 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12958
Close 12958
Close 12955
Close 12956
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12960
WriteX 12960 8191 1 1
QUERY_FILE_INFORMATION 12960
WriteX 12960 0 10438 10438
Close 12960
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12961
Close 12961
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12962
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12963
Close 12963
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12964
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12965
Close 12965
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12966
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12967
FIND_FIRST \clients\client1\~dmtmp\*
Close 12967
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12968
Close 12968
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12969
ReadX 12969 0 4096 4096
Close 12969
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12970
ReadX 12970 0 8192 8192
Close 12970
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12971
ReadX 12971 0 8192 8192
ReadX 12971 8192 4096 4096
ReadX 12971 12288 8192 8192
ReadX 12971 20480 8192 8192
ReadX 12971 28672 8192 8192
ReadX 12971 36864 8192 8192
ReadX 12971 45056 8192 8192
ReadX 12971 53248 8192 8192
ReadX 12971 61440 8192 8192
ReadX 12971 69632 8192 8192
ReadX 12971 77824 8192 8192
ReadX 12971 86016 8192 8192
ReadX 12971 94208 8192 8192
ReadX 12971 102400 8192 8192
ReadX 12971 110592 8192 8192
ReadX 12971 118784 8192 8192
ReadX 12971 126976 8192 8192
ReadX 12971 135168 8192 8192
ReadX 12971 143360 8192 8192
ReadX 12971 151552 8192 8192
ReadX 12971 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 12972
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12972
Close 12971
Close 12962
Close 12964
Close 12966
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 12973
Close 12973
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12975
WriteX 12975 8191 1 1
QUERY_FILE_INFORMATION 12975
WriteX 12975 0 28489 28489
Close 12975
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12976
Close 12976
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12977
FIND_FIRST \clients\client1\~dmtmp\*
Close 12977
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12978
Close 12978
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12979
ReadX 12979 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12980
Close 12980
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12979
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12981
Close 12981
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12982
ReadX 12982 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12983
ReadX 12983 0 8192 8192
ReadX 12983 8192 8192 8192
ReadX 12983 16384 8192 8192
ReadX 12983 24576 8192 8192
ReadX 12983 32768 16384 16384
ReadX 12983 49152 8192 8192
ReadX 12983 57344 8192 8192
ReadX 12983 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12985
Close 12985
Close 12982
Close 12983
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12987
WriteX 12987 8191 1 1
QUERY_FILE_INFORMATION 12987
WriteX 12987 0 29253 29253
Close 12987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12988
Close 12988
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12989
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 12990
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12990
Close 12989
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 12991
Close 12991
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12993
WriteX 12993 8191 1 1
QUERY_FILE_INFORMATION 12993
WriteX 12993 0 30183 30183
Close 12993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12994
Close 12994
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12995
WriteX 12995 0 510 510
WriteX 12995 510 512 512
WriteX 12995 1022 510 510
WriteX 12995 1532 510 510
WriteX 12995 2042 168 168
Close 12995
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12996
Close 12996
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12997
ReadX 12997 0 4096 4096
WriteX 12997 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12998
ReadX 12998 0 65471 65471
ReadX 12998 65471 65 65
ReadX 12998 65536 65471 65471
ReadX 12998 131007 65 65
ReadX 12998 131072 65471 65471
ReadX 12998 196543 65 65
ReadX 12998 196608 65471 65471
ReadX 12998 262079 65 65
ReadX 12998 262144 65471 65471
ReadX 12998 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12999
ReadX 12999 0 65471 65471
ReadX 12999 65471 65 65
ReadX 12999 65536 65471 65471
ReadX 12999 131007 65 65
ReadX 12999 131072 65471 65471
ReadX 12999 196543 65 65
ReadX 12999 196608 65471 65471
ReadX 12999 262079 65 65
ReadX 12999 262144 65471 65471
ReadX 12999 327615 65 65
ReadX 12999 327680 65471 65471
ReadX 12999 393151 65 65
ReadX 12999 393216 65471 65471
ReadX 12999 458687 65 65
ReadX 12999 458752 65471 65471
ReadX 12999 524223 65 65
ReadX 12999 524288 65471 65471
ReadX 12999 589759 65 65
ReadX 12999 589824 65471 65471
ReadX 12999 655295 65 65
ReadX 12999 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13000
ReadX 13000 0 65471 65471
ReadX 13000 65471 65 65
ReadX 13000 65536 65471 65471
ReadX 13000 131007 65 65
ReadX 13000 131072 65471 65471
ReadX 13000 196543 65 65
ReadX 13000 196608 65471 65471
ReadX 13000 262079 65 65
ReadX 13000 262144 65471 65471
ReadX 13000 327615 65 65
ReadX 13000 327680 65471 65471
ReadX 13000 393151 65 65
ReadX 13000 393216 65471 65471
ReadX 13000 458687 65 65
ReadX 13000 458752 65471 65471
ReadX 13000 524223 65 65
ReadX 13000 524288 65471 65471
ReadX 13000 589759 65 65
ReadX 13000 589824 65471 65471
ReadX 13000 655295 65 65
ReadX 13000 655360 65471 65471
ReadX 13000 720831 65 65
ReadX 13000 720896 65471 65471
ReadX 13000 786367 65 65
ReadX 13000 786432 65471 65471
ReadX 13000 851903 65 65
ReadX 13000 851968 65471 65471
ReadX 13000 917439 65 65
ReadX 13000 917504 65471 65471
ReadX 13000 982975 65 65
ReadX 13000 983040 65471 65471
ReadX 13000 1048511 65 65
ReadX 13000 1048576 65471 65471
ReadX 13000 1114047 65 65
ReadX 13000 1114112 65471 65471
ReadX 13000 1179583 65 65
ReadX 13000 1179648 65471 65471
ReadX 13000 1245119 65 65
ReadX 13000 1245184 65471 65471
ReadX 13000 1310655 65 65
ReadX 13000 1310720 65471 65471
ReadX 13000 1376191 65 65
ReadX 13000 1376256 65471 65471
ReadX 13000 1441727 65 65
ReadX 13000 1441792 65471 65471
ReadX 13000 1507263 65 65
ReadX 13000 1507328 65471 65471
ReadX 13000 1572799 65 65
ReadX 13000 1572864 65471 65471
ReadX 13000 1638335 65 65
ReadX 13000 1638400 65471 65471
ReadX 13000 1703871 65 65
ReadX 13000 1703936 65471 65471
ReadX 13000 1769407 65 65
ReadX 13000 1769472 65471 65471
ReadX 13000 1834943 65 65
ReadX 13000 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13001
ReadX 13001 0 4096 4096
ReadX 13001 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13002
WriteX 13002 52 1 1
QUERY_FILE_INFORMATION 13002
WriteX 13002 0 53 53
Close 13002
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13003
Close 13003
Close 12997
Close 12998
Close 12999
Close 13000
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13001 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13004
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13001 0 4096 4096
ReadX 13001 4096 4096 4096
ReadX 13001 8192 4096 4096
ReadX 13001 12288 4096 4096
WriteX 13004 15359 1 1
QUERY_FILE_INFORMATION 13004
ReadX 13001 16384 4096 4096
ReadX 13001 20480 4096 4096
WriteX 13004 0 15360 15360
Close 13004
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13005
ReadX 13005 0 4096 4096
WriteX 13005 0 4096 4096
Close 13005
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13006
Close 13006
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13007
ReadX 13007 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13008
Close 13008
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13001
ReadX 13007 0 4096 4096
ReadX 13007 4096 4096 4096
ReadX 13007 8192 4096 4096
ReadX 13007 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13009
ReadX 13009 0 4096 4096
ReadX 13009 0 4096 4096
ReadX 13009 4096 4096 4096
ReadX 13009 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13010
ReadX 13010 0 4096 4096
ReadX 13010 4096 4096 4096
ReadX 13010 8192 4096 4096
Close 13009
Close 13010
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13011
WriteX 13011 15359 1 1
QUERY_FILE_INFORMATION 13011
WriteX 13011 0 15360 15360
Close 13011
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13012
ReadX 13012 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13007
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13013
Close 13013
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13014
ReadX 13014 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13015
Close 13015
WriteX 13012 0 4096 4096
Close 13012
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13016
Close 13016
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13017
ReadX 13017 0 4096 4096
ReadX 13017 0 4096 4096
ReadX 13017 4096 4096 4096
ReadX 13017 8192 4096 4096
ReadX 13017 12288 3072 3072
ReadX 13017 0 8192 8192
ReadX 13017 8192 4096 4096
ReadX 13017 12288 3072 3072
WriteX 13017 15469 1 1
QUERY_FILE_INFORMATION 13017
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13018
ReadX 13018 0 4096 4096
ReadX 13018 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13019
WriteX 13019 52 1 1
QUERY_FILE_INFORMATION 13019
WriteX 13019 0 53 53
Close 13019
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13020
Close 13020
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13021
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13018 0 8192 8192
ReadX 13018 8192 4096 4096
ReadX 13018 12288 4096 4096
WriteX 13021 12005 1 1
QUERY_FILE_INFORMATION 13021
WriteX 13021 0 12006 12006
Close 13021
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13022
ReadX 13022 0 4096 4096
WriteX 13022 0 4096 4096
Close 13022
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13023
Close 13023
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13024
ReadX 13024 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13025
Close 13025
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13018
ReadX 13024 0 4096 4096
ReadX 13024 4096 4096 4096
ReadX 13024 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13026
WriteX 13026 11990 1 1
QUERY_FILE_INFORMATION 13026
WriteX 13026 0 11991 11991
Close 13026
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13027
ReadX 13027 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13024
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13028
Close 13028
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13029
ReadX 13029 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13030
Close 13030
WriteX 13027 0 4096 4096
Close 13027
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13031
Close 13031
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13032
ReadX 13032 0 4096 4096
ReadX 13032 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13033
Close 13033
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13032 0 8192 8192
ReadX 13032 8192 3799 3799
WriteX 13032 13247 1 1
QUERY_FILE_INFORMATION 13032
WriteX 13032 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13032 0 8192 8192
ReadX 13032 8192 4096 4096
Close 13014
WriteX 13017 0 19054 19054
Close 13017
WriteX 13032 0 12288 12288
Close 13032
Close 13029
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13034
Close 13034
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13035
Close 13035
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13036
ReadX 13036 61440 4096 4096
ReadX 13036 126976 4096 4096
WriteX 13036 0 65471 65471
WriteX 13036 65471 65 65
WriteX 13036 65536 65471 65471
WriteX 13036 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13037
ReadX 13037 61440 4096 4096
ReadX 13037 126976 4096 4096
ReadX 13037 192512 4096 4096
ReadX 13037 258048 4096 4096
WriteX 13037 0 65471 65471
WriteX 13037 65471 65 65
WriteX 13037 65536 65471 65471
WriteX 13037 131007 65 65
WriteX 13037 131072 65471 65471
WriteX 13037 196543 65 65
WriteX 13037 196608 65471 65471
WriteX 13037 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13038
ReadX 13038 61440 4096 4096
ReadX 13038 126976 4096 4096
ReadX 13038 192512 4096 4096
ReadX 13038 258048 4096 4096
ReadX 13038 323584 4096 4096
ReadX 13038 389120 4096 4096
ReadX 13038 454656 4096 4096
ReadX 13038 520192 4096 4096
WriteX 13038 0 65471 65471
WriteX 13038 65471 65 65
WriteX 13038 65536 65471 65471
WriteX 13038 131007 65 65
WriteX 13038 131072 65471 65471
WriteX 13038 196543 65 65
WriteX 13038 196608 65471 65471
WriteX 13038 262079 65 65
WriteX 13038 262144 65471 65471
WriteX 13038 327615 65 65
WriteX 13038 327680 65471 65471
WriteX 13038 393151 65 65
WriteX 13038 393216 65471 65471
WriteX 13038 458687 65 65
WriteX 13038 458752 65471 65471
WriteX 13038 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13039
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13039 0 4096 4096
Close 13039
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13040
ReadX 13040 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13040
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13041
ReadX 13041 0 4096 4096
ReadX 13041 4096 4096 4096
ReadX 13041 8192 4096 4096
ReadX 13041 12288 4096 4096
ReadX 13041 16384 4096 4096
ReadX 13041 20480 4096 4096
ReadX 13041 24576 4096 4096
ReadX 13041 28672 4096 4096
ReadX 13041 32768 4096 4096
ReadX 13041 36864 4096 4096
ReadX 13041 40960 4096 4096
ReadX 13041 45056 4096 4096
ReadX 13041 49152 4096 4096
ReadX 13041 53248 4096 4096
ReadX 13041 57344 4096 4096
ReadX 13041 61440 4096 4096
ReadX 13041 65536 4096 4096
ReadX 13041 69632 4096 4096
ReadX 13041 73728 4096 4096
WriteX 13041 0 4096 4096
Close 13041
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13042
Close 13042
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13043
ReadX 13043 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13044
Close 13044
Close 13036
Close 13037
Close 13038
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13043
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13046
WriteX 13046 4607 1 1
QUERY_FILE_INFORMATION 13046
WriteX 13046 0 65471 65471
WriteX 13046 65471 65 65
WriteX 13046 65536 19979 19979
Close 13046
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13047
ReadX 13047 0 4096 4096
WriteX 13047 0 4096 4096
Flush 13047
WriteX 13047 0 4096 4096
Flush 13047
QUERY_FILE_INFORMATION 13047
WriteX 13047 0 4096 4096
Flush 13047
WriteX 13047 0 4096 4096
Flush 13047
WriteX 13047 0 4096 4096
Flush 13047
WriteX 13047 0 4096 4096
Flush 13047
Close 13047
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13048
ReadX 13048 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13049
ReadX 13049 0 4096 4096
Close 13048
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13050
ReadX 13050 0 4096 4096
Close 13050
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13051
ReadX 13051 0 4096 4096
Close 13051
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13052
ReadX 13052 0 4096 4096
WriteX 13052 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13053
Close 13053
Close 13049
Close 13052
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13054
Close 13054
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13056
WriteX 13056 4607 1 1
QUERY_FILE_INFORMATION 13056
WriteX 13056 0 65471 65471
WriteX 13056 65471 65 65
WriteX 13056 65536 17654 17654
Close 13056
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13057
ReadX 13057 0 4096 4096
WriteX 13057 0 4096 4096
Flush 13057
WriteX 13057 0 4096 4096
Flush 13057
QUERY_FILE_INFORMATION 13057
WriteX 13057 0 4096 4096
Flush 13057
WriteX 13057 0 4096 4096
Flush 13057
WriteX 13057 0 4096 4096
Flush 13057
WriteX 13057 0 4096 4096
Flush 13057
Close 13057
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13058
Close 13058
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13059
ReadX 13059 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13060
Close 13060
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13061
ReadX 13061 0 4096 4096
ReadX 13061 4096 4096 4096
ReadX 13061 8192 4096 4096
ReadX 13061 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13061 16384 4096 4096
ReadX 13061 20480 4096 4096
ReadX 13061 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13059
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13062
ReadX 13062 0 4096 4096
Close 13062
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13063
ReadX 13063 0 4096 4096
Close 13063
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13064
ReadX 13064 0 4096 4096
WriteX 13064 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13065
Close 13065
Close 13064
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13066
Close 13066
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13068
WriteX 13068 4607 1 1
QUERY_FILE_INFORMATION 13068
WriteX 13068 0 65471 65471
WriteX 13068 65471 65 65
WriteX 13068 65536 19490 19490
Close 13068
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13069
ReadX 13069 0 4096 4096
WriteX 13069 0 4096 4096
Flush 13069
WriteX 13069 0 4096 4096
Flush 13069
QUERY_FILE_INFORMATION 13069
WriteX 13069 0 4096 4096
Flush 13069
WriteX 13069 0 4096 4096
Flush 13069
WriteX 13069 0 4096 4096
Flush 13069
WriteX 13069 0 4096 4096
Flush 13069
Close 13069
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13070
Close 13070
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13071
ReadX 13071 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13072
Close 13072
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13071
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13073
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13073 0 4096 4096
Close 13073
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13074
ReadX 13074 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13074
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13075
ReadX 13075 0 4096 4096
ReadX 13075 4096 4096 4096
ReadX 13075 8192 4096 4096
ReadX 13075 12288 4096 4096
ReadX 13075 16384 4096 4096
ReadX 13075 20480 4096 4096
ReadX 13075 24576 4096 4096
ReadX 13075 28672 4096 4096
ReadX 13075 32768 4096 4096
ReadX 13075 36864 4096 4096
ReadX 13075 40960 4096 4096
ReadX 13075 45056 4096 4096
ReadX 13075 49152 4096 4096
ReadX 13075 53248 4096 4096
ReadX 13075 57344 4096 4096
ReadX 13075 61440 4096 4096
ReadX 13075 65536 4096 4096
ReadX 13075 69632 4096 4096
ReadX 13075 73728 4096 4096
WriteX 13075 0 4096 4096
Close 13075
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13076
Close 13076
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13077
ReadX 13077 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13078
Close 13078
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13077
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13080
WriteX 13080 4607 1 1
QUERY_FILE_INFORMATION 13080
WriteX 13080 0 65471 65471
WriteX 13080 65471 65 65
WriteX 13080 65536 8866 8866
Close 13080
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13081
ReadX 13081 0 4096 4096
WriteX 13081 0 4096 4096
Flush 13081
WriteX 13081 0 4096 4096
Flush 13081
Close 13081
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13082
ReadX 13082 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13082
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13083
ReadX 13083 0 4096 4096
Close 13083
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13084
ReadX 13084 0 4096 4096
Close 13084
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13085
ReadX 13085 0 4096 4096
WriteX 13085 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13086
Close 13086
Close 13085
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13087
Close 13087
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13089
WriteX 13089 4607 1 1
QUERY_FILE_INFORMATION 13089
WriteX 13089 0 65471 65471
WriteX 13089 65471 65 65
WriteX 13089 65536 9298 9298
Close 13089
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13090
ReadX 13090 0 4096 4096
WriteX 13090 0 4096 4096
Flush 13090
WriteX 13090 0 4096 4096
Flush 13090
Close 13090
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13091
Close 13091
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13092
ReadX 13092 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13093
Close 13093
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13095
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13095 0 4096 4096
Close 13095
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13096
ReadX 13096 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13096 4096 4096 4096
ReadX 13096 8192 4096 4096
ReadX 13096 12288 4096 4096
ReadX 13096 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13092
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13097
ReadX 13097 0 4096 4096
Close 13097
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13098
ReadX 13098 0 4096 4096
Close 13098
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13099
ReadX 13099 0 4096 4096
WriteX 13099 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13100
Close 13100
Close 13096
Close 13099
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13101
Close 13101
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13103
WriteX 13103 4607 1 1
QUERY_FILE_INFORMATION 13103
WriteX 13103 0 65471 65471
WriteX 13103 65471 65 65
WriteX 13103 65536 11540 11540
Close 13103
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13104
ReadX 13104 0 4096 4096
WriteX 13104 0 4096 4096
Flush 13104
WriteX 13104 0 4096 4096
Flush 13104
Close 13104
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13105
Close 13105
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13106
ReadX 13106 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13107
Close 13107
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13106
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13108
ReadX 13108 0 65471 65471
ReadX 13108 65471 65 65
ReadX 13108 65536 65471 65471
ReadX 13108 131007 65 65
ReadX 13108 131072 65471 65471
ReadX 13108 196543 65 65
ReadX 13108 196608 65471 65471
ReadX 13108 262079 65 65
ReadX 13108 262144 65471 65471
ReadX 13108 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13109
ReadX 13109 0 65471 65471
ReadX 13109 65471 65 65
ReadX 13109 65536 65471 65471
ReadX 13109 131007 65 65
ReadX 13109 131072 65471 65471
ReadX 13109 196543 65 65
ReadX 13109 196608 65471 65471
ReadX 13109 262079 65 65
ReadX 13109 262144 65471 65471
ReadX 13109 327615 65 65
ReadX 13109 327680 65471 65471
ReadX 13109 393151 65 65
ReadX 13109 393216 65471 65471
ReadX 13109 458687 65 65
ReadX 13109 458752 65471 65471
ReadX 13109 524223 65 65
ReadX 13109 524288 65471 65471
ReadX 13109 589759 65 65
ReadX 13109 589824 65471 65471
ReadX 13109 655295 65 65
ReadX 13109 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13110
ReadX 13110 0 65471 65471
ReadX 13110 65471 65 65
ReadX 13110 65536 65471 65471
ReadX 13110 131007 65 65
ReadX 13110 131072 65471 65471
ReadX 13110 196543 65 65
ReadX 13110 196608 65471 65471
ReadX 13110 262079 65 65
ReadX 13110 262144 65471 65471
ReadX 13110 327615 65 65
ReadX 13110 327680 65471 65471
ReadX 13110 393151 65 65
ReadX 13110 393216 65471 65471
ReadX 13110 458687 65 65
ReadX 13110 458752 65471 65471
ReadX 13110 524223 65 65
ReadX 13110 524288 65471 65471
ReadX 13110 589759 65 65
ReadX 13110 589824 65471 65471
ReadX 13110 655295 65 65
ReadX 13110 655360 65471 65471
ReadX 13110 720831 65 65
ReadX 13110 720896 65471 65471
ReadX 13110 786367 65 65
ReadX 13110 786432 65471 65471
ReadX 13110 851903 65 65
ReadX 13110 851968 65471 65471
ReadX 13110 917439 65 65
ReadX 13110 917504 65471 65471
ReadX 13110 982975 65 65
ReadX 13110 983040 65471 65471
ReadX 13110 1048511 65 65
ReadX 13110 1048576 65471 65471
ReadX 13110 1114047 65 65
ReadX 13110 1114112 65471 65471
ReadX 13110 1179583 65 65
ReadX 13110 1179648 65471 65471
ReadX 13110 1245119 65 65
ReadX 13110 1245184 65471 65471
ReadX 13110 1310655 65 65
ReadX 13110 1310720 65471 65471
ReadX 13110 1376191 65 65
ReadX 13110 1376256 65471 65471
ReadX 13110 1441727 65 65
ReadX 13110 1441792 65471 65471
ReadX 13110 1507263 65 65
ReadX 13110 1507328 65471 65471
ReadX 13110 1572799 65 65
ReadX 13110 1572864 65471 65471
ReadX 13110 1638335 65 65
ReadX 13110 1638400 65471 65471
ReadX 13110 1703871 65 65
ReadX 13110 1703936 65471 65471
ReadX 13110 1769407 65 65
ReadX 13110 1769472 65471 65471
ReadX 13110 1834943 65 65
ReadX 13110 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13111
FIND_FIRST \clients\client1\~dmtmp\*
Close 13111
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13112
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13113
QUERY_FILE_INFORMATION 13113
QUERY_FILE_INFORMATION 13113
QUERY_FILE_INFORMATION 13113
ReadX 13113 2156 24 24
ReadX 13113 2139 276 276
ReadX 13113 2136 14 14
ReadX 13113 2136 7 7
ReadX 13113 2138 12 12
ReadX 13113 2137 8 8
ReadX 13113 2135 15 15
ReadX 13113 0 16 16
ReadX 13113 16 2048 2048
ReadX 13113 2064 2048 2048
ReadX 13113 257 2048 2048
ReadX 13113 385 2048 2048
ReadX 13113 513 2048 2048
ReadX 13113 641 2048 2048
ReadX 13113 769 2048 2048
ReadX 13113 897 2048 2048
ReadX 13113 1025 2048 2048
ReadX 13113 1153 2048 2048
ReadX 13113 1281 2048 2048
ReadX 13113 1409 2048 2048
ReadX 13113 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13115
Close 13115
Close 13061
Close 13108
Close 13109
Close 13110
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13117
WriteX 13117 15 1 1
QUERY_FILE_INFORMATION 13117
WriteX 13117 0 10575 10575
Flush 13117
Close 13117
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13118
Close 13118
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13119
ReadX 13119 0 4096 4096
Close 13113
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13120
Close 13120
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13121
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13122
QUERY_FILE_INFORMATION 13122
ReadX 13122 0 512 512
ReadX 13122 512 512 512
ReadX 13122 1024 512 512
QUERY_FILE_INFORMATION 13122
QUERY_FILE_INFORMATION 13122
Close 13122
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13123
QUERY_FILE_INFORMATION 13123
ReadX 13123 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13124
QUERY_FILE_INFORMATION 13124
ReadX 13124 0 512 512
ReadX 13124 512 512 512
ReadX 13124 1024 512 512
ReadX 13124 288 20 20
ReadX 13124 308 2084 2084
ReadX 13124 388 2084 2084
ReadX 13124 388 2084 2084
ReadX 13112 2157 1386 1386
ReadX 13124 2472 399 399
ReadX 13124 3072 1536 1536
ReadX 13124 544 149 149
ReadX 13124 693 485 485
Close 13124
ReadX 13112 2157 4096 4096
ReadX 13112 6253 4096 4096
ReadX 13112 10349 4096 4096
ReadX 13112 14445 4096 4096
ReadX 13112 18541 4096 4096
ReadX 13112 22637 256 256
ReadX 13112 22893 4096 4096
ReadX 13112 26989 4096 4096
ReadX 13112 31085 4096 4096
ReadX 13112 35181 4096 4096
ReadX 13112 39277 4096 4096
ReadX 13112 43373 4096 4096
ReadX 13112 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13112 2157 1024 1024
ReadX 13112 1667 4688 4688
ReadX 13112 6355 3516 3516
ReadX 13112 9871 16384 16384
ReadX 13112 26255 3771 3771
ReadX 13112 30026 2048 2048
ReadX 13112 32074 1024 1024
ReadX 13112 33098 6652 6652
ReadX 13112 39750 16384 16384
ReadX 13112 56134 10496 10496
ReadX 13112 66630 1784 1784
ReadX 13112 68414 90 90
ReadX 13112 68504 273 273
ReadX 13112 68777 1600 1600
ReadX 13112 70377 640 640
ReadX 13112 71017 1280 1280
ReadX 13112 72297 8464 8464
ReadX 13112 80761 158 158
ReadX 13112 80919 912 912
ReadX 13112 81831 1980 1980
ReadX 13112 83811 2256 2256
ReadX 13112 86067 400 400
ReadX 13112 86467 252 252
ReadX 13112 86719 42 42
ReadX 13112 86761 725 725
ReadX 13112 2009 512 512
ReadX 13112 3895 9 9
ReadX 13112 3781 46 46
ReadX 13112 4059 92 92
ReadX 13112 3781 92 92
ReadX 13112 3986 184 184
ReadX 13112 3987 16384 16384
ReadX 13112 3902 16384 16384
ReadX 13112 3781 10240 10240
ReadX 13112 3821 16384 16384
ReadX 13112 3891 935 935
ReadX 13112 4060 10240 10240
ReadX 13112 4059 184 184
ReadX 13112 256 184 184
ReadX 13112 256 1026 1026
ReadX 13112 3901 326 326
ReadX 13112 3899 652 652
ReadX 13112 256 2 2
ReadX 13112 258 4948 4948
Close 13112
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13126
Close 13126
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13128
WriteX 13128 4055 1 1
QUERY_FILE_INFORMATION 13128
WriteX 13128 0 65471 65471
WriteX 13128 65471 65 65
WriteX 13128 65536 65471 65471
WriteX 13128 131007 65 65
WriteX 13128 131072 65471 65471
WriteX 13128 196543 65 65
WriteX 13128 196608 65471 65471
WriteX 13128 262079 65 65
WriteX 13128 262144 65471 65471
WriteX 13128 327615 65 65
WriteX 13128 327680 65471 65471
WriteX 13128 393151 65 65
WriteX 13128 393216 65471 65471
WriteX 13128 458687 65 65
WriteX 13128 458752 65471 65471
WriteX 13128 524223 65 65
WriteX 13128 524288 65471 65471
WriteX 13128 589759 65 65
WriteX 13128 589824 35257 35257
Close 13128
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13130
Close 13130
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13132
WriteX 13132 4055 1 1
QUERY_FILE_INFORMATION 13132
WriteX 13132 0 65471 65471
WriteX 13132 65471 65 65
WriteX 13132 65536 65471 65471
WriteX 13132 131007 65 65
WriteX 13132 131072 65471 65471
WriteX 13132 196543 65 65
WriteX 13132 196608 65471 65471
WriteX 13132 262079 65 65
WriteX 13132 262144 65471 65471
WriteX 13132 327615 65 65
WriteX 13132 327680 65471 65471
WriteX 13132 393151 65 65
WriteX 13132 393216 65471 65471
WriteX 13132 458687 65 65
WriteX 13132 458752 65471 65471
WriteX 13132 524223 65 65
WriteX 13132 524288 65471 65471
WriteX 13132 589759 65 65
WriteX 13132 589824 57598 57598
Close 13132
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13134
WriteX 13134 15 1 1
QUERY_FILE_INFORMATION 13134
WriteX 13134 0 12543 12543
Flush 13134
Close 13134
Close 13119
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13135
Close 13135
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13136
ReadX 13136 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13137
FIND_FIRST \clients\client1\~dmtmp\*
Close 13137
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13138
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13139
QUERY_FILE_INFORMATION 13139
QUERY_FILE_INFORMATION 13139
QUERY_FILE_INFORMATION 13139
ReadX 13139 1938 24 24
ReadX 13139 1920 276 276
ReadX 13139 1918 14 14
ReadX 13139 1918 7 7
ReadX 13139 1919 12 12
ReadX 13139 1919 8 8
ReadX 13139 1917 15 15
ReadX 13139 0 16 16
ReadX 13139 16 2048 2048
ReadX 13139 2064 2048 2048
ReadX 13139 257 2048 2048
ReadX 13139 385 2048 2048
ReadX 13139 513 2048 2048
ReadX 13139 641 2048 2048
ReadX 13139 769 2048 2048
ReadX 13139 897 2048 2048
ReadX 13139 1025 2048 2048
ReadX 13139 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13141
Close 13141
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13143
WriteX 13143 15 1 1
QUERY_FILE_INFORMATION 13143
WriteX 13143 0 11588 11588
Flush 13143
Close 13143
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13144
Close 13144
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13145
ReadX 13145 0 4096 4096
Close 13139
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13147
WriteX 13147 15 1 1
QUERY_FILE_INFORMATION 13147
WriteX 13147 0 11615 11615
Flush 13147
Close 13147
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13145
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13148
Close 13148
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13149
ReadX 13149 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13151
Close 13151
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13153
WriteX 13153 4088 1 1
QUERY_FILE_INFORMATION 13153
WriteX 13153 0 65471 65471
WriteX 13153 65471 65 65
WriteX 13153 65536 16050 16050
Close 13153
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13138 1939 64 64
ReadX 13138 128 248 248
ReadX 13138 128 568 568
ReadX 13138 3872 1536 1536
ReadX 13138 3456 2560 2560
ReadX 13138 3136 512 512
ReadX 13138 2880 4096 4096
ReadX 13138 3264 3072 3072
ReadX 13138 320 4096 4096
ReadX 13138 1024 4096 4096
ReadX 13138 3616 4096 4096
ReadX 13138 1939 64 64
ReadX 13138 128 248 248
ReadX 13138 128 608 608
ReadX 13138 2858 1024 1024
ReadX 13138 2810 4096 4096
ReadX 13138 2826 4096 4096
ReadX 13138 2580 2048 2048
ReadX 13138 2800 2560 2560
ReadX 13138 2100 4096 4096
ReadX 13138 2084 4096 4096
ReadX 13138 868 4096 4096
ReadX 13138 2324 4096 4096
ReadX 13138 884 4096 4096
ReadX 13138 2604 1024 1024
ReadX 13138 580 4096 4096
ReadX 13138 596 4096 4096
ReadX 13138 2752 4096 4096
ReadX 13138 2842 1024 1024
ReadX 13138 660 4096 4096
ReadX 13138 2720 4096 4096
ReadX 13138 2736 4096 4096
ReadX 13138 628 4096 4096
ReadX 13138 2704 4096 4096
ReadX 13138 1556 4096 4096
ReadX 13138 576 4096 4096
ReadX 13138 3168 1536 1536
ReadX 13138 832 4096 4096
ReadX 13138 1088 4096 4096
ReadX 13138 1344 4096 4096
ReadX 13138 1600 4096 4096
ReadX 13138 1856 4096 4096
ReadX 13138 2112 4096 4096
ReadX 13138 1892 4096 4096
ReadX 13138 820 4096 4096
ReadX 13138 788 4096 4096
ReadX 13138 1604 4096 4096
ReadX 13138 3648 4096 4096
ReadX 13138 2608 4096 4096
ReadX 13138 548 4096 4096
ReadX 13138 740 4096 4096
ReadX 13138 1344 4096 4096
ReadX 13138 3392 4096 4096
ReadX 13138 3904 4096 4096
ReadX 13138 644 4096 4096
ReadX 13138 676 4096 4096
ReadX 13138 2688 4096 4096
ReadX 13138 320 4096 4096
ReadX 13138 900 4096 4096
ReadX 13138 1908 4096 4096
ReadX 13138 852 4096 4096
ReadX 13138 724 4096 4096
ReadX 13138 2292 4096 4096
ReadX 13138 612 4096 4096
ReadX 13138 388 4096 4096
ReadX 13138 2368 4096 4096
ReadX 13138 2624 4096 4096
ReadX 13138 500 4096 4096
ReadX 13138 356 4096 4096
ReadX 13138 1024 4096 4096
ReadX 13138 576 4096 4096
ReadX 13138 340 4096 4096
ReadX 13138 420 4096 4096
ReadX 13138 1600 4096 4096
ReadX 13138 404 4096 4096
ReadX 13138 1428 4096 4096
ReadX 13138 2656 4096 4096
ReadX 13138 2624 4096 4096
ReadX 13138 452 4096 4096
ReadX 13138 692 4096 4096
ReadX 13138 564 4096 4096
ReadX 13138 372 4096 4096
ReadX 13138 468 4096 4096
ReadX 13138 484 4096 4096
ReadX 13138 1088 4096 4096
ReadX 13138 1924 4096 4096
ReadX 13138 2768 4096 4096
ReadX 13138 832 4096 4096
ReadX 13138 836 4096 4096
ReadX 13138 1856 4096 4096
ReadX 13138 2640 4096 4096
ReadX 13138 436 4096 4096
ReadX 13138 1828 4096 4096
ReadX 13138 804 4096 4096
ReadX 13138 1860 4096 4096
ReadX 13138 1812 4096 4096
ReadX 13138 756 4096 4096
ReadX 13138 1636 4096 4096
ReadX 13138 772 4096 4096
ReadX 13138 2036 4096 4096
ReadX 13138 1220 4096 4096
ReadX 13138 1652 4096 4096
ReadX 13138 2588 4096 4096
ReadX 13138 916 4096 4096
ReadX 13138 260 4096 4096
ReadX 13138 932 4096 4096
ReadX 13138 2624 4096 4096
ReadX 13138 308 4096 4096
ReadX 13138 292 4096 4096
ReadX 13138 1140 4096 4096
ReadX 13138 276 4096 4096
ReadX 13138 2020 4096 4096
ReadX 13138 2880 4096 4096
ReadX 13138 516 4096 4096
ReadX 13138 1844 4096 4096
ReadX 13138 1124 4096 4096
ReadX 13138 3136 4096 4096
ReadX 13138 324 4096 4096
ReadX 13138 1156 4096 4096
ReadX 13138 1172 4096 4096
ReadX 13138 2112 4096 4096
ReadX 13138 2368 4096 4096
ReadX 13138 964 4096 4096
ReadX 13138 980 4096 4096
ReadX 13138 1012 4096 4096
ReadX 13138 532 4096 4096
ReadX 13138 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13138 1620 4096 4096
ReadX 13138 1604 4096 4096
ReadX 13138 2116 4096 4096
ReadX 13138 2132 4096 4096
ReadX 13138 2148 4096 4096
ReadX 13138 2276 4096 4096
ReadX 13138 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13155
Close 13155
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13157
QUERY_FILE_INFORMATION 13121
Close 13121
WriteX 13157 4088 1 1
QUERY_FILE_INFORMATION 13157
QUERY_FILE_INFORMATION 13123
Close 13123
WriteX 13157 0 65471 65471
WriteX 13157 65471 65 65
WriteX 13157 65536 64850 64850
Close 13157
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13159
WriteX 13159 15 1 1
QUERY_FILE_INFORMATION 13159
ReadX 13138 2068 4096 4096
ReadX 13138 1588 4096 4096
ReadX 13138 1572 4096 4096
WriteX 13159 0 18630 18630
Flush 13159
Close 13159
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13149
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13160
Close 13160
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13161
ReadX 13161 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13138 612 4096 4096
ReadX 13138 564 4096 4096
ReadX 13138 1876 4096 4096
ReadX 13138 628 4096 4096
ReadX 13138 740 4096 4096
ReadX 13138 724 4096 4096
ReadX 13138 644 4096 4096
ReadX 13138 2324 4096 4096
ReadX 13138 660 4096 4096
ReadX 13138 852 4096 4096
ReadX 13138 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13138 2368 4096 4096
ReadX 13138 1024 4096 4096
ReadX 13138 320 4096 4096
ReadX 13138 580 4096 4096
ReadX 13138 3136 512 512
ReadX 13138 2880 4096 4096
Close 13138
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13162
ReadX 13162 61440 4096 4096
ReadX 13162 126976 4096 4096
WriteX 13162 0 65471 65471
WriteX 13162 65471 65 65
WriteX 13162 65536 65471 65471
WriteX 13162 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13163
ReadX 13163 61440 4096 4096
ReadX 13163 126976 4096 4096
ReadX 13163 192512 4096 4096
ReadX 13163 258048 4096 4096
WriteX 13163 0 65471 65471
WriteX 13163 65471 65 65
WriteX 13163 65536 65471 65471
WriteX 13163 131007 65 65
WriteX 13163 131072 65471 65471
WriteX 13163 196543 65 65
WriteX 13163 196608 65471 65471
WriteX 13163 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13164
ReadX 13164 61440 4096 4096
ReadX 13164 126976 4096 4096
ReadX 13164 192512 4096 4096
ReadX 13164 258048 4096 4096
ReadX 13164 323584 4096 4096
ReadX 13164 389120 4096 4096
ReadX 13164 454656 4096 4096
ReadX 13164 520192 4096 4096
WriteX 13164 0 65471 65471
WriteX 13164 65471 65 65
WriteX 13164 65536 65471 65471
WriteX 13164 131007 65 65
WriteX 13164 131072 65471 65471
WriteX 13164 196543 65 65
WriteX 13164 196608 65471 65471
WriteX 13164 262079 65 65
WriteX 13164 262144 65471 65471
WriteX 13164 327615 65 65
WriteX 13164 327680 65471 65471
WriteX 13164 393151 65 65
WriteX 13164 393216 65471 65471
WriteX 13164 458687 65 65
WriteX 13164 458752 65471 65471
WriteX 13164 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13165
Close 13165
Close 13161
Close 13136
Close 13162
Close 13163
Close 13164
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13166
Close 13166
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13169
Close 13169
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13171
Close 13171
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13172
Close 13172
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13175
Close 13175
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13177
Close 13177
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13178
Close 13178
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13181
Close 13181
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13185
Close 13185
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13189
Close 13189
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13193
Close 13193
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13197
Close 13197
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13201
Close 13201
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13205
Close 13205
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13209
Close 13209
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13211
Close 13211
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13213
Close 13213
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13215
WriteX 13215 4095 1 1
QUERY_FILE_INFORMATION 13215
QUERY_FS_INFORMATION 259
WriteX 13215 0 65471 65471
WriteX 13215 65471 65 65
WriteX 13215 65536 65471 65471
WriteX 13215 131007 65 65
WriteX 13215 131072 65471 65471
WriteX 13215 196543 65 65
WriteX 13215 196608 65471 65471
WriteX 13215 262079 65 65
WriteX 13215 262144 26634 26634
Close 13215
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13220
Close 13220
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13221
Close 13221
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13222
ReadX 13222 0 4096 4096
Close 13222
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13223
ReadX 13223 0 4096 4096
ReadX 13223 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13224
Close 13224
Close 13223
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13227
Close 13227
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13229
Close 13229
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13230
Close 13230
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13233
Close 13233
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13235
Close 13235
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13236
Close 13236
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13239
Close 13239
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13243
Close 13243
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13247
Close 13247
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13251
Close 13251
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13255
Close 13255
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13259
Close 13259
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13262
Close 13262
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13266
Close 13266
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13270
Close 13270
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13272
Close 13272
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13273
Close 13273
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13282
Close 13282
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13283
FIND_FIRST \clients\client1\~dmtmp\*
Close 13283
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13284
Close 13284
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13285
ReadX 13285 0 4096 4096
Close 13285
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13286
ReadX 13286 0 4096 4096
Close 13286
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13287
ReadX 13287 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13297
Close 13297
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13298
FIND_FIRST \clients\client1\~dmtmp\*
Close 13298
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13299
Close 13299
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13300
ReadX 13300 0 4096 4096
Close 13300
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13301
ReadX 13301 0 4096 4096
Close 13301
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13302
ReadX 13302 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13303
ReadX 13303 0 65471 65471
ReadX 13303 65471 65 65
ReadX 13303 65536 65471 65471
ReadX 13303 131007 65 65
ReadX 13303 131072 65471 65471
ReadX 13303 196543 65 65
ReadX 13303 196608 65471 65471
ReadX 13303 262079 65 65
ReadX 13303 262144 65471 65471
ReadX 13303 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13304
ReadX 13304 0 65471 65471
ReadX 13304 65471 65 65
ReadX 13304 65536 65471 65471
ReadX 13304 131007 65 65
ReadX 13304 131072 65471 65471
ReadX 13304 196543 65 65
ReadX 13304 196608 65471 65471
ReadX 13304 262079 65 65
ReadX 13304 262144 65471 65471
ReadX 13304 327615 65 65
ReadX 13304 327680 65471 65471
ReadX 13304 393151 65 65
ReadX 13304 393216 65471 65471
ReadX 13304 458687 65 65
ReadX 13304 458752 65471 65471
ReadX 13304 524223 65 65
ReadX 13304 524288 65471 65471
ReadX 13304 589759 65 65
ReadX 13304 589824 65471 65471
ReadX 13304 655295 65 65
ReadX 13304 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13305
ReadX 13305 0 65471 65471
ReadX 13305 65471 65 65
ReadX 13305 65536 65471 65471
ReadX 13305 131007 65 65
ReadX 13305 131072 65471 65471
ReadX 13305 196543 65 65
ReadX 13305 196608 65471 65471
ReadX 13305 262079 65 65
ReadX 13305 262144 65471 65471
ReadX 13305 327615 65 65
ReadX 13305 327680 65471 65471
ReadX 13305 393151 65 65
ReadX 13305 393216 65471 65471
ReadX 13305 458687 65 65
ReadX 13305 458752 65471 65471
ReadX 13305 524223 65 65
ReadX 13305 524288 65471 65471
ReadX 13305 589759 65 65
ReadX 13305 589824 65471 65471
ReadX 13305 655295 65 65
ReadX 13305 655360 65471 65471
ReadX 13305 720831 65 65
ReadX 13305 720896 65471 65471
ReadX 13305 786367 65 65
ReadX 13305 786432 65471 65471
ReadX 13305 851903 65 65
ReadX 13305 851968 65471 65471
ReadX 13305 917439 65 65
ReadX 13305 917504 65471 65471
ReadX 13305 982975 65 65
ReadX 13305 983040 65471 65471
ReadX 13305 1048511 65 65
ReadX 13305 1048576 65471 65471
ReadX 13305 1114047 65 65
ReadX 13305 1114112 65471 65471
ReadX 13305 1179583 65 65
ReadX 13305 1179648 65471 65471
ReadX 13305 1245119 65 65
ReadX 13305 1245184 65471 65471
ReadX 13305 1310655 65 65
ReadX 13305 1310720 65471 65471
ReadX 13305 1376191 65 65
ReadX 13305 1376256 65471 65471
ReadX 13305 1441727 65 65
ReadX 13305 1441792 65471 65471
ReadX 13305 1507263 65 65
ReadX 13305 1507328 65471 65471
ReadX 13305 1572799 65 65
ReadX 13305 1572864 65471 65471
ReadX 13305 1638335 65 65
ReadX 13305 1638400 65471 65471
ReadX 13305 1703871 65 65
ReadX 13305 1703936 65471 65471
ReadX 13305 1769407 65 65
ReadX 13305 1769472 65471 65471
ReadX 13305 1834943 65 65
ReadX 13305 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13306
ReadX 13306 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13306 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13306 8192 4096 4096
ReadX 13306 12288 4096 4096
ReadX 13306 16384 4096 4096
ReadX 13306 20480 4096 4096
ReadX 13306 24576 4096 4096
ReadX 13306 28672 4096 4096
ReadX 13306 32768 4096 4096
ReadX 13306 36864 4096 4096
ReadX 13306 40960 4096 4096
ReadX 13306 45056 4096 4096
ReadX 13306 49152 4096 4096
ReadX 13306 53248 4096 4096
ReadX 13306 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13306 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13307
Close 13307
Close 13287
Close 13302
Close 13303
Close 13304
Close 13305
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13308
WriteX 13308 1535 1 1
QUERY_FILE_INFORMATION 13308
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13306 0 4096 4096
ReadX 13306 4096 4096 4096
QUERY_FILE_INFORMATION 13308
WriteX 13308 0 57088 57088
WriteX 13308 0 4096 4096
Flush 13308
Close 13306
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13309
Close 13309
WriteX 13308 0 4096 4096
Close 13308
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13310
Close 13310
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13311
ReadX 13311 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13311 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13312
WriteX 13312 1535 1 1
QUERY_FILE_INFORMATION 13312
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13311 0 4096 4096
QUERY_FILE_INFORMATION 13312
WriteX 13312 0 51456 51456
WriteX 13312 0 4096 4096
Flush 13312
Close 13311
WriteX 13312 0 4096 4096
Close 13312
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13313
Close 13313
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13314
ReadX 13314 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13314 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13316
Close 13316
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13318
WriteX 13318 4045 1 1
QUERY_FILE_INFORMATION 13318
WriteX 13318 0 53077 53077
Close 13318
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13319
WriteX 13319 1535 1 1
QUERY_FILE_INFORMATION 13319
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13314 0 4096 4096
QUERY_FILE_INFORMATION 13319
WriteX 13319 0 65471 65471
WriteX 13319 65471 65 65
WriteX 13319 65536 1856 1856
WriteX 13319 0 4096 4096
Flush 13319
Close 13314
WriteX 13319 0 4096 4096
Close 13319
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13320
Close 13320
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13321
ReadX 13321 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13323
Close 13323
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13325
WriteX 13325 4076 1 1
QUERY_FILE_INFORMATION 13325
WriteX 13325 0 7983 7983
Close 13325
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13327
Close 13327
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13329
WriteX 13329 4095 1 1
QUERY_FILE_INFORMATION 13329
WriteX 13329 0 65471 65471
WriteX 13329 65471 65 65
WriteX 13329 65536 65471 65471
WriteX 13329 131007 65 65
WriteX 13329 131072 65471 65471
WriteX 13329 196543 65 65
WriteX 13329 196608 65471 65471
WriteX 13329 262079 65 65
WriteX 13329 262144 65471 65471
WriteX 13329 327615 65 65
WriteX 13329 327680 65471 65471
WriteX 13329 393151 65 65
WriteX 13329 393216 65471 65471
WriteX 13329 458687 65 65
WriteX 13329 458752 46731 46731
Close 13329
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13330
WriteX 13330 1535 1 1
QUERY_FILE_INFORMATION 13330
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13321 0 4096 4096
ReadX 13321 4096 4096 4096
QUERY_FILE_INFORMATION 13330
WriteX 13330 0 65471 65471
WriteX 13330 65471 65 65
WriteX 13330 65536 22848 22848
WriteX 13330 0 4096 4096
Flush 13330
Close 13321
WriteX 13330 0 4096 4096
Close 13330
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13331
Close 13331
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13332
ReadX 13332 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13332 4096 4096 4096
Close 13332
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13333
ReadX 13333 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13333 0 8192 8192
ReadX 13333 8192 4096 4096
ReadX 13333 12288 4096 4096
ReadX 13333 16384 4096 4096
ReadX 13333 20480 4096 4096
ReadX 13333 24576 4096 4096
ReadX 13333 28672 4096 4096
ReadX 13333 32768 4096 4096
ReadX 13333 36864 4096 4096
ReadX 13333 40960 4096 4096
ReadX 13333 45056 4096 4096
ReadX 13333 49152 4096 4096
ReadX 13333 53248 4096 4096
ReadX 13333 57344 4096 4096
ReadX 13333 61440 4096 4096
ReadX 13333 65536 4096 4096
ReadX 13333 69632 4096 4096
ReadX 13333 73728 4096 4096
ReadX 13333 77824 4096 4096
ReadX 13333 81920 4096 4096
ReadX 13333 86016 4096 4096
ReadX 13333 90112 4096 4096
ReadX 13333 94208 4096 4096
ReadX 13333 98304 4096 4096
ReadX 13333 102400 4096 4096
ReadX 13333 106496 4096 4096
ReadX 13333 110592 4096 4096
ReadX 13333 114688 4096 4096
ReadX 13333 118784 4096 4096
ReadX 13333 122880 4096 4096
ReadX 13333 126976 4096 4096
ReadX 13333 131072 4096 4096
ReadX 13333 135168 4096 4096
ReadX 13333 139264 4096 4096
ReadX 13333 143360 4096 4096
ReadX 13333 147456 4096 4096
ReadX 13333 151552 4096 4096
ReadX 13333 155648 4096 4096
ReadX 13333 159744 4096 4096
ReadX 13333 163840 4096 4096
ReadX 13333 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13333 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13334
Close 13334
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13335
WriteX 13335 2047 1 1
QUERY_FILE_INFORMATION 13335
Close 13333
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13336
Close 13336
WriteX 13335 0 42388 42388
Close 13335
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13337
Close 13337
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13338
ReadX 13338 0 4096 4096
ReadX 13338 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13339
WriteX 13339 2047 1 1
QUERY_FILE_INFORMATION 13339
Close 13338
WriteX 13339 0 42652 42652
Close 13339
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13340
Close 13340
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13341
ReadX 13341 0 4096 4096
ReadX 13341 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13343
Close 13343
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13345
WriteX 13345 4080 1 1
QUERY_FILE_INFORMATION 13345
WriteX 13345 0 65471 65471
WriteX 13345 65471 65 65
WriteX 13345 65536 49 49
Close 13345
Close 13341
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13346
ReadX 13346 61440 4096 4096
ReadX 13346 126976 4096 4096
WriteX 13346 0 65471 65471
WriteX 13346 65471 65 65
WriteX 13346 65536 65471 65471
WriteX 13346 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13347
ReadX 13347 61440 4096 4096
ReadX 13347 126976 4096 4096
ReadX 13347 192512 4096 4096
ReadX 13347 258048 4096 4096
WriteX 13347 0 65471 65471
WriteX 13347 65471 65 65
WriteX 13347 65536 65471 65471
WriteX 13347 131007 65 65
WriteX 13347 131072 65471 65471
WriteX 13347 196543 65 65
WriteX 13347 196608 65471 65471
WriteX 13347 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13348
ReadX 13348 61440 4096 4096
ReadX 13348 126976 4096 4096
ReadX 13348 192512 4096 4096
ReadX 13348 258048 4096 4096
ReadX 13348 323584 4096 4096
ReadX 13348 389120 4096 4096
ReadX 13348 454656 4096 4096
ReadX 13348 520192 4096 4096
WriteX 13348 0 65471 65471
WriteX 13348 65471 65 65
WriteX 13348 65536 65471 65471
WriteX 13348 131007 65 65
WriteX 13348 131072 65471 65471
WriteX 13348 196543 65 65
WriteX 13348 196608 65471 65471
WriteX 13348 262079 65 65
WriteX 13348 262144 65471 65471
WriteX 13348 327615 65 65
WriteX 13348 327680 65471 65471
WriteX 13348 393151 65 65
WriteX 13348 393216 65471 65471
WriteX 13348 458687 65 65
WriteX 13348 458752 65471 65471
WriteX 13348 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13349
FIND_FIRST \clients\client1\~dmtmp\*
Close 13349
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13350
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13350 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13351
ReadX 13351 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13352
ReadX 13352 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13353
ReadX 13353 0 4096 4096
ReadX 13350 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13350
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13354
ReadX 13354 0 4096 4096
ReadX 13354 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13355
FIND_FIRST \clients\client1\~dmtmp\*
Close 13355
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13356
QUERY_FILE_INFORMATION 13356
WriteX 13356 2047 1 1
QUERY_FILE_INFORMATION 13356
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13357
Close 13357
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13358
WriteX 13358 52 1 1
QUERY_FILE_INFORMATION 13358
WriteX 13358 0 491 491
Close 13358
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13359
ReadX 13359 0 491 491
WriteX 13356 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13354
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13360
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13360 0 4096 4096
ReadX 13360 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13362
Close 13362
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13363
WriteX 13363 52 1 1
QUERY_FILE_INFORMATION 13363
WriteX 13363 0 543 543
Close 13363
Close 13360
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13364
ReadX 13364 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13365
ReadX 13365 0 543 543
ReadX 13364 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13364
Close 13359
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13346
Close 13347
Close 13348
Close 13365
Close 13351
Close 13352
Close 13353
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13356
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13366
FIND_FIRST \clients\client1\~dmtmp\*
Close 13366
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13367
ReadX 13367 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13368
ReadX 13368 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13369
ReadX 13369 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13370
ReadX 13370 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13371
ReadX 13371 0 543 543
ReadX 13367 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13375
FIND_FIRST \clients\client1\~dmtmp\*
Close 13375
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13376
QUERY_FILE_INFORMATION 13376
WriteX 13376 2047 1 1
QUERY_FILE_INFORMATION 13376
WriteX 13376 0 2048 2048
Close 13376
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13377
ReadX 13377 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13377
Close 13367
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13378
ReadX 13378 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13378 4095 1 1
QUERY_FILE_INFORMATION 13378
ReadX 13378 0 4096 4096
WriteX 13378 0 4096 4096
Flush 13378
WriteX 13378 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13379
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13379 0 4096 4096
ReadX 13379 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13383
FIND_FIRST \clients\client1\~dmtmp\*
Close 13383
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13384
WriteX 13384 2047 1 1
QUERY_FILE_INFORMATION 13384
WriteX 13384 0 2048 2048
Close 13384
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13385
ReadX 13385 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13389
Close 13389
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13390
WriteX 13390 2047 1 1
QUERY_FILE_INFORMATION 13390
WriteX 13390 0 2048 2048
Close 13390
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13391
ReadX 13391 0 2048 2048
ReadX 13379 4096 16384 16384
Close 13391
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13392
ReadX 13392 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13392
Close 13371
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13385 4095 1 1
QUERY_FILE_INFORMATION 13385
ReadX 13385 0 4096 4096
WriteX 13385 0 4096 4096
Close 13385
WriteX 13379 0 8192 8192
Close 13379
WriteX 13368 0 4096 4096
WriteX 13369 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13394
ReadX 13394 0 4096 4096
ReadX 13394 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13394
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13395
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13395 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13396
ReadX 13396 0 543 543
ReadX 13395 0 4096 4096
Close 13395
Close 13378
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13397
QUERY_FILE_INFORMATION 13397
Close 13397
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13396
Close 13368
Close 13369
Close 13370
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13398
FIND_FIRST \clients\client1\~dmtmp\*
Close 13398
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13399
ReadX 13399 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13400
ReadX 13400 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13401
ReadX 13401 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13402
ReadX 13402 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13403
ReadX 13403 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13404
ReadX 13404 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13405
ReadX 13405 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13406
ReadX 13406 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13407
ReadX 13407 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13408
ReadX 13408 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13409
ReadX 13409 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13410
ReadX 13410 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13411
ReadX 13411 0 4096 4096
ReadX 13399 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13415
FIND_FIRST \clients\client1\~dmtmp\*
Close 13415
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13416
QUERY_FILE_INFORMATION 13416
WriteX 13416 2047 1 1
QUERY_FILE_INFORMATION 13416
WriteX 13416 0 2048 2048
Close 13416
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13417
ReadX 13417 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13417
Close 13407
Close 13399
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13418
ReadX 13418 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13419
FIND_FIRST \clients\client1\~dmtmp\*
Close 13419
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13420
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13420 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13421
ReadX 13421 0 4096 4096
ReadX 13420 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13425
FIND_FIRST \clients\client1\~dmtmp\*
Close 13425
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13426
QUERY_FILE_INFORMATION 13426
WriteX 13426 2047 1 1
QUERY_FILE_INFORMATION 13426
WriteX 13426 0 2048 2048
Close 13426
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13427
ReadX 13427 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13427
Close 13420
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13428
ReadX 13428 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13418 4095 1 1
QUERY_FILE_INFORMATION 13418
ReadX 13418 0 4096 4096
WriteX 13418 0 4096 4096
Flush 13418
WriteX 13428 4095 1 1
QUERY_FILE_INFORMATION 13428
ReadX 13428 0 4096 4096
WriteX 13428 0 4096 4096
Flush 13428
WriteX 13418 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 13428 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13429
ReadX 13429 0 4096 4096
ReadX 13421 0 4096 4096
ReadX 13429 0 4096 4096
ReadX 13429 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13430
FIND_FIRST \clients\client1\~dmtmp\*
Close 13430
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13431
WriteX 13431 4095 1 1
QUERY_FILE_INFORMATION 13431
WriteX 13431 0 4096 4096
Close 13431
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13432
ReadX 13432 0 4096 4096
Close 13429
Close 13421
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13433
Close 13433
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13434
WriteX 13434 4095 1 1
QUERY_FILE_INFORMATION 13434
WriteX 13434 0 4096 4096
Close 13434
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13435
ReadX 13435 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 13435 0 4096 4096
Close 13432
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13411
Close 13405
Close 13408
Close 13409
Close 13410
Close 13406
Close 13400
Close 13403
Close 13404
Close 13401
Close 13402
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13435
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13437
Close 13437
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13438
ReadX 13438 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13439
Close 13439
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13440
WriteX 13440 2047 1 1
QUERY_FILE_INFORMATION 13440
WriteX 13440 0 2048 2048
Close 13440
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13441
ReadX 13441 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13441
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13442
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13442 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13443
ReadX 13443 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13444
ReadX 13444 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13445
ReadX 13445 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13446
ReadX 13446 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13447
ReadX 13447 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13448
ReadX 13448 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13449
ReadX 13449 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13450
ReadX 13450 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13451
ReadX 13451 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13452
ReadX 13452 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13453
ReadX 13453 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13454
ReadX 13454 0 4096 4096
ReadX 13442 0 4096 4096
ReadX 13449 0 4096 4096
Close 13449
Close 13442
Close 13418
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13455
QUERY_FILE_INFORMATION 13455
Close 13455
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13438
Close 13453
Close 13448
Close 13450
Close 13451
Close 13452
Close 13454
Close 13443
Close 13446
Close 13447
Close 13444
Close 13445
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13428
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13456
QUERY_FILE_INFORMATION 13456
Close 13456
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13457
FIND_FIRST \clients\client1\~dmtmp\*
Close 13457
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13458
ReadX 13458 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13459
ReadX 13459 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13460
ReadX 13460 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13461
ReadX 13461 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13462
ReadX 13462 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13463
ReadX 13463 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13464
ReadX 13464 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13465
ReadX 13465 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13466
ReadX 13466 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13467
ReadX 13467 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13468
ReadX 13468 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13469
ReadX 13469 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13470
ReadX 13470 0 4096 4096
ReadX 13458 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13474
FIND_FIRST \clients\client1\~dmtmp\*
Close 13474
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13475
QUERY_FILE_INFORMATION 13475
WriteX 13475 2047 1 1
QUERY_FILE_INFORMATION 13475
WriteX 13475 0 2048 2048
Close 13475
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13476
ReadX 13476 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13476
Close 13458
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13477
ReadX 13477 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13478
FIND_FIRST \clients\client1\~dmtmp\*
Close 13478
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13479
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13479 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13480
ReadX 13480 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13481
ReadX 13481 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13482
ReadX 13482 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13483
ReadX 13483 0 543 543
ReadX 13479 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13487
FIND_FIRST \clients\client1\~dmtmp\*
Close 13487
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13488
QUERY_FILE_INFORMATION 13488
WriteX 13488 2047 1 1
QUERY_FILE_INFORMATION 13488
WriteX 13488 0 2048 2048
Close 13488
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13489
ReadX 13489 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13489
Close 13479
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13490
ReadX 13490 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 13463
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13491
FIND_FIRST \clients\client1\~dmtmp\*
Close 13491
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13492
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13492 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13493
ReadX 13493 0 4096 4096
ReadX 13492 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13497
FIND_FIRST \clients\client1\~dmtmp\*
Close 13497
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13498
QUERY_FILE_INFORMATION 13498
WriteX 13498 2047 1 1
QUERY_FILE_INFORMATION 13498
WriteX 13498 0 2048 2048
Close 13498
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13499
ReadX 13499 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13499
Close 13493
Close 13492
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13500
ReadX 13500 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13477 4095 1 1
QUERY_FILE_INFORMATION 13477
ReadX 13477 0 4096 4096
WriteX 13477 0 4096 4096
Flush 13477
WriteX 13490 4095 1 1
QUERY_FILE_INFORMATION 13490
ReadX 13490 0 4096 4096
WriteX 13490 0 4096 4096
Flush 13490
WriteX 13500 4095 1 1
QUERY_FILE_INFORMATION 13500
ReadX 13500 0 4096 4096
WriteX 13500 0 4096 4096
Flush 13500
WriteX 13477 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 13490 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 13500 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13501
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13501 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13502
ReadX 13502 0 4096 4096
ReadX 13501 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13503
ReadX 13503 0 4096 4096
ReadX 13503 0 4096 4096
ReadX 13503 4096 16384 16384
ReadX 13501 4096 16384 16384
ReadX 13501 0 4096 4096
ReadX 13502 0 4096 4096
ReadX 13502 4096 4096 4096
Close 13503
Close 13502
Close 13501
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13504
FIND_FIRST \clients\client1\~dmtmp\*
Close 13504
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13505
ReadX 13505 0 2048 2048
WriteX 13505 18431 1 1
QUERY_FILE_INFORMATION 13505
WriteX 13505 0 19584 19584
Close 13505
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13506
ReadX 13506 0 4096 4096
ReadX 13506 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13506
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13507
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13507 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13508
ReadX 13508 0 4096 4096
ReadX 13507 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13509
ReadX 13509 0 4096 4096
ReadX 13509 0 4096 4096
Close 13509
Close 13508
Close 13507
Close 13477
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13510
QUERY_FILE_INFORMATION 13510
Close 13510
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13483
Close 13470
Close 13462
Close 13480
Close 13481
Close 13482
Close 13469
Close 13464
Close 13467
Close 13468
Close 13465
Close 13466
Close 13459
Close 13460
Close 13461
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13490
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13511
QUERY_FILE_INFORMATION 13511
Close 13511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13500
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13512
QUERY_FILE_INFORMATION 13512
Close 13512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13513
FIND_FIRST \clients\client1\~dmtmp\*
Close 13513
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13514
ReadX 13514 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13515
ReadX 13515 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13516
ReadX 13516 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13517
ReadX 13517 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13518
ReadX 13518 0 543 543
ReadX 13514 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13514 4096 16384 16384
WriteX 13514 0 4096 4096
Close 13514
WriteX 13515 0 4096 4096
WriteX 13516 0 4096 4096
WriteX 13517 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13519
FIND_FIRST \clients\client1\~dmtmp\*
Close 13519
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13520
ReadX 13520 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13521
ReadX 13521 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13522
ReadX 13522 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13523
ReadX 13523 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13524
ReadX 13524 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13525
ReadX 13525 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13526
ReadX 13526 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13527
ReadX 13527 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13528
ReadX 13528 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13529
ReadX 13529 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13530
ReadX 13530 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13531
ReadX 13531 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13532
ReadX 13532 0 4096 4096
ReadX 13520 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13533
ReadX 13533 0 8192 8192
ReadX 13520 4096 16384 16384
Close 13527
Close 13520
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13534
FIND_FIRST \clients\client1\~dmtmp\*
Close 13534
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13535
ReadX 13535 0 4096 4096
ReadX 13535 4096 4096 4096
ReadX 13535 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13536
ReadX 13536 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13537
ReadX 13537 0 4096 4096
ReadX 13536 0 4096 4096
ReadX 13536 0 4096 4096
ReadX 13536 4096 16384 16384
Close 13537
WriteX 13536 0 4096 4096
Close 13536
WriteX 13521 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13538
FIND_FIRST \clients\client1\~dmtmp\*
Close 13538
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13539
ReadX 13539 0 4096 4096
ReadX 13539 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13540
ReadX 13540 0 4096 4096
ReadX 13540 0 4096 4096
WriteX 13540 0 4096 4096
Close 13540
WriteX 13515 0 4096 4096
WriteX 13516 0 4096 4096
WriteX 13517 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13541
ReadX 13541 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13542
ReadX 13542 0 4096 4096
ReadX 13541 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13546
FIND_FIRST \clients\client1\~dmtmp\*
Close 13546
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13547
QUERY_FILE_INFORMATION 13547
WriteX 13547 2047 1 1
QUERY_FILE_INFORMATION 13547
WriteX 13547 0 2048 2048
Close 13547
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13548
ReadX 13548 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13548 4095 1 1
QUERY_FILE_INFORMATION 13548
ReadX 13548 0 4096 4096
WriteX 13548 0 4096 4096
Close 13548
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13549
ReadX 13549 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13549 0 4096 4096
Close 13542
Close 13541
WriteX 13549 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13550
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13550 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13551
ReadX 13551 0 4096 4096
ReadX 13550 0 4096 4096
ReadX 13550 4096 16384 16384
Close 13551
Close 13550
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13552
FIND_FIRST \clients\client1\~dmtmp\*
Close 13552
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13553
ReadX 13553 0 4096 4096
ReadX 13553 4096 4096 4096
WriteX 13553 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13553 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13553
ReadX 13549 0 4096 4096
WriteX 13549 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13554
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13554 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13555
ReadX 13555 0 4096 4096
ReadX 13554 0 4096 4096
ReadX 13554 4096 16384 16384
Close 13555
Close 13554
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13556
FIND_FIRST \clients\client1\~dmtmp\*
Close 13556
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13557
ReadX 13557 0 4096 4096
ReadX 13557 4096 4096 4096
WriteX 13557 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13557 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13557
Close 13549
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13558
QUERY_FILE_INFORMATION 13558
Close 13558
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13533
Close 13535
Close 13539
Close 13518
Close 13515
Close 13516
Close 13517
Close 13526
Close 13531
Close 13528
Close 13529
Close 13530
Close 13532
Close 13521
Close 13524
Close 13525
Close 13522
Close 13523
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13559
FIND_FIRST \clients\client1\~dmtmp\*
Close 13559
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13560
ReadX 13560 0 4096 4096
ReadX 13560 4096 4096 4096
ReadX 13560 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13561
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13561 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13562
ReadX 13562 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13563
ReadX 13563 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13564
ReadX 13564 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13565
ReadX 13565 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13566
ReadX 13566 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13567
ReadX 13567 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13568
ReadX 13568 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13569
ReadX 13569 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13570
ReadX 13570 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13571
ReadX 13571 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13572
ReadX 13572 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13573
ReadX 13573 0 4096 4096
ReadX 13561 0 4096 4096
ReadX 13561 0 4096 4096
ReadX 13561 4096 16384 16384
Close 13568
Close 13561
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13574
ReadX 13574 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13575
ReadX 13575 0 4096 4096
ReadX 13574 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13579
FIND_FIRST \clients\client1\~dmtmp\*
Close 13579
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13580
QUERY_FILE_INFORMATION 13580
WriteX 13580 2047 1 1
QUERY_FILE_INFORMATION 13580
WriteX 13580 0 2048 2048
Close 13580
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13581
ReadX 13581 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13581 4095 1 1
QUERY_FILE_INFORMATION 13581
ReadX 13581 0 4096 4096
WriteX 13581 0 4096 4096
Close 13581
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13582
ReadX 13582 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13582 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13586
Close 13586
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13587
QUERY_FILE_INFORMATION 13587
WriteX 13587 2047 1 1
QUERY_FILE_INFORMATION 13587
WriteX 13587 0 2048 2048
Close 13587
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13588
ReadX 13588 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13588 4095 1 1
QUERY_FILE_INFORMATION 13588
ReadX 13588 0 4096 4096
WriteX 13588 0 4096 4096
Close 13588
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13589
ReadX 13589 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13589 0 4096 4096
Close 13574
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13590
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13590 0 4096 4096
ReadX 13590 0 4096 4096
ReadX 13590 4096 16384 16384
Close 13590
Close 13582
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13591
QUERY_FILE_INFORMATION 13591
Close 13591
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13560
Close 13572
Close 13567
Close 13573
Close 13575
Close 13562
Close 13565
Close 13566
Close 13563
Close 13564
Close 13569
Close 13570
Close 13571
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13589
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13592
QUERY_FILE_INFORMATION 13592
Close 13592
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13593
ReadX 13593 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13594
Close 13594
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13595
WriteX 13595 63 1 1
QUERY_FILE_INFORMATION 13595
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13593 0 4096 4096
ReadX 13593 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13593 0 8192 8192
Flush 13593
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13593 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13593 0 8192 8192
Flush 13593
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13593 0 8192 8192
Flush 13593
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13593 0 8192 8192
Flush 13593
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13597
Close 13597
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13599
WriteX 13599 4065 1 1
QUERY_FILE_INFORMATION 13599
WriteX 13599 0 62591 62591
Close 13599
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13601
Close 13601
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13603
WriteX 13603 4094 1 1
QUERY_FILE_INFORMATION 13603
WriteX 13603 0 10845 10845
Close 13603
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13605
Close 13605
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13607
WriteX 13607 4081 1 1
QUERY_FILE_INFORMATION 13607
WriteX 13607 0 30118 30118
Close 13607
WriteX 13593 0 4096 4096
Close 13593
WriteX 13595 0 64 64
Close 13595
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13608
ReadX 13608 61440 4096 4096
ReadX 13608 126976 4096 4096
WriteX 13608 0 65471 65471
WriteX 13608 65471 65 65
WriteX 13608 65536 65471 65471
WriteX 13608 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13609
ReadX 13609 61440 4096 4096
ReadX 13609 126976 4096 4096
ReadX 13609 192512 4096 4096
ReadX 13609 258048 4096 4096
WriteX 13609 0 65471 65471
WriteX 13609 65471 65 65
WriteX 13609 65536 65471 65471
WriteX 13609 131007 65 65
WriteX 13609 131072 65471 65471
WriteX 13609 196543 65 65
WriteX 13609 196608 65471 65471
WriteX 13609 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13610
ReadX 13610 61440 4096 4096
ReadX 13610 126976 4096 4096
ReadX 13610 192512 4096 4096
ReadX 13610 258048 4096 4096
ReadX 13610 323584 4096 4096
ReadX 13610 389120 4096 4096
ReadX 13610 454656 4096 4096
ReadX 13610 520192 4096 4096
WriteX 13610 0 65471 65471
WriteX 13610 65471 65 65
WriteX 13610 65536 65471 65471
WriteX 13610 131007 65 65
WriteX 13610 131072 65471 65471
WriteX 13610 196543 65 65
WriteX 13610 196608 65471 65471
WriteX 13610 262079 65 65
WriteX 13610 262144 65471 65471
WriteX 13610 327615 65 65
WriteX 13610 327680 65471 65471
WriteX 13610 393151 65 65
WriteX 13610 393216 65471 65471
WriteX 13610 458687 65 65
WriteX 13610 458752 65471 65471
WriteX 13610 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13611
Close 13611
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13608
Close 13609
Close 13610
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13612
ReadX 13612 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13613
ReadX 13613 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13614
ReadX 13614 0 4096 4096
ReadX 13614 4096 4096 4096
ReadX 13614 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13615
Close 13615
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13612
Close 13613
Close 13614
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13616
Close 13616
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13617
ReadX 13617 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13618
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13618
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13619
Close 13619
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13620
ReadX 13620 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13621
Close 13621
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13617
Close 13620
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13622
Close 13622
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13623
ReadX 13623 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13624
ReadX 13624 0 8192 8192
ReadX 13624 8192 8192 8192
ReadX 13624 16384 8192 8192
ReadX 13624 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13626
Close 13626
Close 13623
Close 13624
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13628
WriteX 13628 8191 1 1
QUERY_FILE_INFORMATION 13628
WriteX 13628 0 10438 10438
Close 13628
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13629
Close 13629
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13630
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13631
Close 13631
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13632
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13633
Close 13633
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13634
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13635
FIND_FIRST \clients\client1\~dmtmp\*
Close 13635
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13636
Close 13636
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13637
ReadX 13637 0 4096 4096
Close 13637
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13638
ReadX 13638 0 8192 8192
Close 13638
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13639
ReadX 13639 0 8192 8192
ReadX 13639 8192 4096 4096
ReadX 13639 12288 8192 8192
ReadX 13639 20480 8192 8192
ReadX 13639 28672 8192 8192
ReadX 13639 36864 8192 8192
ReadX 13639 45056 8192 8192
ReadX 13639 53248 8192 8192
ReadX 13639 61440 8192 8192
ReadX 13639 69632 8192 8192
ReadX 13639 77824 8192 8192
ReadX 13639 86016 8192 8192
ReadX 13639 94208 8192 8192
ReadX 13639 102400 8192 8192
ReadX 13639 110592 8192 8192
ReadX 13639 118784 8192 8192
ReadX 13639 126976 8192 8192
ReadX 13639 135168 8192 8192
ReadX 13639 143360 8192 8192
ReadX 13639 151552 8192 8192
ReadX 13639 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13640
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13640
Close 13639
Close 13630
Close 13632
Close 13634
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13641
Close 13641
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13643
WriteX 13643 8191 1 1
QUERY_FILE_INFORMATION 13643
WriteX 13643 0 28489 28489
Close 13643
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13644
Close 13644
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13645
FIND_FIRST \clients\client1\~dmtmp\*
Close 13645
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13646
Close 13646
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13647
ReadX 13647 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13648
Close 13648
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13647
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13649
Close 13649
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13650
ReadX 13650 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13651
ReadX 13651 0 8192 8192
ReadX 13651 8192 8192 8192
ReadX 13651 16384 8192 8192
ReadX 13651 24576 8192 8192
ReadX 13651 32768 16384 16384
ReadX 13651 49152 8192 8192
ReadX 13651 57344 8192 8192
ReadX 13651 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13653
Close 13653
Close 13650
Close 13651
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13655
WriteX 13655 8191 1 1
QUERY_FILE_INFORMATION 13655
WriteX 13655 0 29253 29253
Close 13655
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13656
Close 13656
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13657
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13658
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13658
Close 13657
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13659
Close 13659
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13661
WriteX 13661 8191 1 1
QUERY_FILE_INFORMATION 13661
WriteX 13661 0 30183 30183
Close 13661
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13662
Close 13662
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13663
WriteX 13663 0 510 510
WriteX 13663 510 512 512
WriteX 13663 1022 510 510
WriteX 13663 1532 510 510
WriteX 13663 2042 168 168
Close 13663
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13664
Close 13664
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13665
ReadX 13665 0 4096 4096
WriteX 13665 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13666
ReadX 13666 0 65471 65471
ReadX 13666 65471 65 65
ReadX 13666 65536 65471 65471
ReadX 13666 131007 65 65
ReadX 13666 131072 65471 65471
ReadX 13666 196543 65 65
ReadX 13666 196608 65471 65471
ReadX 13666 262079 65 65
ReadX 13666 262144 65471 65471
ReadX 13666 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13667
ReadX 13667 0 65471 65471
ReadX 13667 65471 65 65
ReadX 13667 65536 65471 65471
ReadX 13667 131007 65 65
ReadX 13667 131072 65471 65471
ReadX 13667 196543 65 65
ReadX 13667 196608 65471 65471
ReadX 13667 262079 65 65
ReadX 13667 262144 65471 65471
ReadX 13667 327615 65 65
ReadX 13667 327680 65471 65471
ReadX 13667 393151 65 65
ReadX 13667 393216 65471 65471
ReadX 13667 458687 65 65
ReadX 13667 458752 65471 65471
ReadX 13667 524223 65 65
ReadX 13667 524288 65471 65471
ReadX 13667 589759 65 65
ReadX 13667 589824 65471 65471
ReadX 13667 655295 65 65
ReadX 13667 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13668
ReadX 13668 0 65471 65471
ReadX 13668 65471 65 65
ReadX 13668 65536 65471 65471
ReadX 13668 131007 65 65
ReadX 13668 131072 65471 65471
ReadX 13668 196543 65 65
ReadX 13668 196608 65471 65471
ReadX 13668 262079 65 65
ReadX 13668 262144 65471 65471
ReadX 13668 327615 65 65
ReadX 13668 327680 65471 65471
ReadX 13668 393151 65 65
ReadX 13668 393216 65471 65471
ReadX 13668 458687 65 65
ReadX 13668 458752 65471 65471
ReadX 13668 524223 65 65
ReadX 13668 524288 65471 65471
ReadX 13668 589759 65 65
ReadX 13668 589824 65471 65471
ReadX 13668 655295 65 65
ReadX 13668 655360 65471 65471
ReadX 13668 720831 65 65
ReadX 13668 720896 65471 65471
ReadX 13668 786367 65 65
ReadX 13668 786432 65471 65471
ReadX 13668 851903 65 65
ReadX 13668 851968 65471 65471
ReadX 13668 917439 65 65
ReadX 13668 917504 65471 65471
ReadX 13668 982975 65 65
ReadX 13668 983040 65471 65471
ReadX 13668 1048511 65 65
ReadX 13668 1048576 65471 65471
ReadX 13668 1114047 65 65
ReadX 13668 1114112 65471 65471
ReadX 13668 1179583 65 65
ReadX 13668 1179648 65471 65471
ReadX 13668 1245119 65 65
ReadX 13668 1245184 65471 65471
ReadX 13668 1310655 65 65
ReadX 13668 1310720 65471 65471
ReadX 13668 1376191 65 65
ReadX 13668 1376256 65471 65471
ReadX 13668 1441727 65 65
ReadX 13668 1441792 65471 65471
ReadX 13668 1507263 65 65
ReadX 13668 1507328 65471 65471
ReadX 13668 1572799 65 65
ReadX 13668 1572864 65471 65471
ReadX 13668 1638335 65 65
ReadX 13668 1638400 65471 65471
ReadX 13668 1703871 65 65
ReadX 13668 1703936 65471 65471
ReadX 13668 1769407 65 65
ReadX 13668 1769472 65471 65471
ReadX 13668 1834943 65 65
ReadX 13668 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13669
ReadX 13669 0 4096 4096
ReadX 13669 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13670
WriteX 13670 52 1 1
QUERY_FILE_INFORMATION 13670
WriteX 13670 0 53 53
Close 13670
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13671
Close 13671
Close 13665
Close 13666
Close 13667
Close 13668
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13669 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13672
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13669 0 4096 4096
ReadX 13669 4096 4096 4096
ReadX 13669 8192 4096 4096
ReadX 13669 12288 4096 4096
WriteX 13672 15359 1 1
QUERY_FILE_INFORMATION 13672
ReadX 13669 16384 4096 4096
ReadX 13669 20480 4096 4096
WriteX 13672 0 15360 15360
Close 13672
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13673
ReadX 13673 0 4096 4096
WriteX 13673 0 4096 4096
Close 13673
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13674
Close 13674
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13675
ReadX 13675 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13676
Close 13676
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13669
ReadX 13675 0 4096 4096
ReadX 13675 4096 4096 4096
ReadX 13675 8192 4096 4096
ReadX 13675 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13677
ReadX 13677 0 4096 4096
ReadX 13677 0 4096 4096
ReadX 13677 4096 4096 4096
ReadX 13677 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13678
ReadX 13678 0 4096 4096
ReadX 13678 4096 4096 4096
ReadX 13678 8192 4096 4096
Close 13677
Close 13678
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13679
WriteX 13679 15359 1 1
QUERY_FILE_INFORMATION 13679
WriteX 13679 0 15360 15360
Close 13679
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13680
ReadX 13680 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13675
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13681
Close 13681
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13682
ReadX 13682 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13683
Close 13683
WriteX 13680 0 4096 4096
Close 13680
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13684
Close 13684
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13685
ReadX 13685 0 4096 4096
ReadX 13685 0 4096 4096
ReadX 13685 4096 4096 4096
ReadX 13685 8192 4096 4096
ReadX 13685 12288 3072 3072
ReadX 13685 0 8192 8192
ReadX 13685 8192 4096 4096
ReadX 13685 12288 3072 3072
WriteX 13685 15469 1 1
QUERY_FILE_INFORMATION 13685
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13686
ReadX 13686 0 4096 4096
ReadX 13686 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13687
WriteX 13687 52 1 1
QUERY_FILE_INFORMATION 13687
WriteX 13687 0 53 53
Close 13687
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13688
Close 13688
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13689
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13686 0 8192 8192
ReadX 13686 8192 4096 4096
ReadX 13686 12288 4096 4096
WriteX 13689 12005 1 1
QUERY_FILE_INFORMATION 13689
WriteX 13689 0 12006 12006
Close 13689
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13690
ReadX 13690 0 4096 4096
WriteX 13690 0 4096 4096
Close 13690
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13691
Close 13691
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13692
ReadX 13692 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13693
Close 13693
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13686
ReadX 13692 0 4096 4096
ReadX 13692 4096 4096 4096
ReadX 13692 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13694
WriteX 13694 11990 1 1
QUERY_FILE_INFORMATION 13694
WriteX 13694 0 11991 11991
Close 13694
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13695
ReadX 13695 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13692
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13696
Close 13696
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13697
ReadX 13697 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13698
Close 13698
WriteX 13695 0 4096 4096
Close 13695
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13699
Close 13699
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13700
ReadX 13700 0 4096 4096
ReadX 13700 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13701
Close 13701
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13700 0 8192 8192
ReadX 13700 8192 3799 3799
WriteX 13700 13247 1 1
QUERY_FILE_INFORMATION 13700
WriteX 13700 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13700 0 8192 8192
ReadX 13700 8192 4096 4096
Close 13682
WriteX 13685 0 19054 19054
Close 13685
WriteX 13700 0 12288 12288
Close 13700
Close 13697
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13702
Close 13702
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13703
Close 13703
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13704
ReadX 13704 61440 4096 4096
ReadX 13704 126976 4096 4096
WriteX 13704 0 65471 65471
WriteX 13704 65471 65 65
WriteX 13704 65536 65471 65471
WriteX 13704 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13705
ReadX 13705 61440 4096 4096
ReadX 13705 126976 4096 4096
ReadX 13705 192512 4096 4096
ReadX 13705 258048 4096 4096
WriteX 13705 0 65471 65471
WriteX 13705 65471 65 65
WriteX 13705 65536 65471 65471
WriteX 13705 131007 65 65
WriteX 13705 131072 65471 65471
WriteX 13705 196543 65 65
WriteX 13705 196608 65471 65471
WriteX 13705 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13706
ReadX 13706 61440 4096 4096
ReadX 13706 126976 4096 4096
ReadX 13706 192512 4096 4096
ReadX 13706 258048 4096 4096
ReadX 13706 323584 4096 4096
ReadX 13706 389120 4096 4096
ReadX 13706 454656 4096 4096
ReadX 13706 520192 4096 4096
WriteX 13706 0 65471 65471
WriteX 13706 65471 65 65
WriteX 13706 65536 65471 65471
WriteX 13706 131007 65 65
WriteX 13706 131072 65471 65471
WriteX 13706 196543 65 65
WriteX 13706 196608 65471 65471
WriteX 13706 262079 65 65
WriteX 13706 262144 65471 65471
WriteX 13706 327615 65 65
WriteX 13706 327680 65471 65471
WriteX 13706 393151 65 65
WriteX 13706 393216 65471 65471
WriteX 13706 458687 65 65
WriteX 13706 458752 65471 65471
WriteX 13706 524223 65 65
Close 13704
Close 13705
Close 13706
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13707
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13707 0 4096 4096
Close 13707
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13708
ReadX 13708 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13708
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13709
ReadX 13709 0 4096 4096
ReadX 13709 4096 4096 4096
ReadX 13709 8192 4096 4096
ReadX 13709 12288 4096 4096
ReadX 13709 16384 4096 4096
ReadX 13709 20480 4096 4096
ReadX 13709 24576 4096 4096
ReadX 13709 28672 4096 4096
ReadX 13709 32768 4096 4096
ReadX 13709 36864 4096 4096
ReadX 13709 40960 4096 4096
ReadX 13709 45056 4096 4096
ReadX 13709 49152 4096 4096
ReadX 13709 53248 4096 4096
ReadX 13709 57344 4096 4096
ReadX 13709 61440 4096 4096
ReadX 13709 65536 4096 4096
ReadX 13709 69632 4096 4096
ReadX 13709 73728 4096 4096
WriteX 13709 0 4096 4096
Close 13709
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13710
Close 13710
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13711
ReadX 13711 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13712
Close 13712
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13711
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13714
WriteX 13714 4607 1 1
QUERY_FILE_INFORMATION 13714
WriteX 13714 0 65471 65471
WriteX 13714 65471 65 65
WriteX 13714 65536 19979 19979
Close 13714
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13715
ReadX 13715 0 4096 4096
WriteX 13715 0 4096 4096
Flush 13715
WriteX 13715 0 4096 4096
Flush 13715
QUERY_FILE_INFORMATION 13715
WriteX 13715 0 4096 4096
Flush 13715
WriteX 13715 0 4096 4096
Flush 13715
WriteX 13715 0 4096 4096
Flush 13715
WriteX 13715 0 4096 4096
Flush 13715
Close 13715
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13716
ReadX 13716 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13717
ReadX 13717 0 4096 4096
Close 13716
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13718
ReadX 13718 0 4096 4096
Close 13718
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13719
ReadX 13719 0 4096 4096
Close 13719
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13720
ReadX 13720 0 4096 4096
WriteX 13720 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13721
Close 13721
Close 13717
Close 13720
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13722
Close 13722
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13724
WriteX 13724 4607 1 1
QUERY_FILE_INFORMATION 13724
WriteX 13724 0 65471 65471
WriteX 13724 65471 65 65
WriteX 13724 65536 17654 17654
Close 13724
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13725
ReadX 13725 0 4096 4096
WriteX 13725 0 4096 4096
Flush 13725
WriteX 13725 0 4096 4096
Flush 13725
QUERY_FILE_INFORMATION 13725
WriteX 13725 0 4096 4096
Flush 13725
WriteX 13725 0 4096 4096
Flush 13725
WriteX 13725 0 4096 4096
Flush 13725
WriteX 13725 0 4096 4096
Flush 13725
Close 13725
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13726
Close 13726
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13727
ReadX 13727 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13728
Close 13728
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13729
ReadX 13729 0 4096 4096
ReadX 13729 4096 4096 4096
ReadX 13729 8192 4096 4096
ReadX 13729 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13729 16384 4096 4096
ReadX 13729 20480 4096 4096
ReadX 13729 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13727
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13730
ReadX 13730 0 4096 4096
Close 13730
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13731
ReadX 13731 0 4096 4096
Close 13731
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13732
ReadX 13732 0 4096 4096
WriteX 13732 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13733
Close 13733
Close 13732
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13734
Close 13734
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13736
WriteX 13736 4607 1 1
QUERY_FILE_INFORMATION 13736
WriteX 13736 0 65471 65471
WriteX 13736 65471 65 65
WriteX 13736 65536 19490 19490
Close 13736
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13737
ReadX 13737 0 4096 4096
WriteX 13737 0 4096 4096
Flush 13737
WriteX 13737 0 4096 4096
Flush 13737
QUERY_FILE_INFORMATION 13737
WriteX 13737 0 4096 4096
Flush 13737
WriteX 13737 0 4096 4096
Flush 13737
WriteX 13737 0 4096 4096
Flush 13737
WriteX 13737 0 4096 4096
Flush 13737
Close 13737
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13738
Close 13738
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13739
ReadX 13739 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13740
Close 13740
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13739
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13741
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13741 0 4096 4096
Close 13741
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13742
ReadX 13742 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13742
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13743
ReadX 13743 0 4096 4096
ReadX 13743 4096 4096 4096
ReadX 13743 8192 4096 4096
ReadX 13743 12288 4096 4096
ReadX 13743 16384 4096 4096
ReadX 13743 20480 4096 4096
ReadX 13743 24576 4096 4096
ReadX 13743 28672 4096 4096
ReadX 13743 32768 4096 4096
ReadX 13743 36864 4096 4096
ReadX 13743 40960 4096 4096
ReadX 13743 45056 4096 4096
ReadX 13743 49152 4096 4096
ReadX 13743 53248 4096 4096
ReadX 13743 57344 4096 4096
ReadX 13743 61440 4096 4096
ReadX 13743 65536 4096 4096
ReadX 13743 69632 4096 4096
ReadX 13743 73728 4096 4096
WriteX 13743 0 4096 4096
Close 13743
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13744
Close 13744
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13745
ReadX 13745 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13746
Close 13746
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13745
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13748
WriteX 13748 4607 1 1
QUERY_FILE_INFORMATION 13748
WriteX 13748 0 65471 65471
WriteX 13748 65471 65 65
WriteX 13748 65536 8866 8866
Close 13748
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13749
ReadX 13749 0 4096 4096
WriteX 13749 0 4096 4096
Flush 13749
WriteX 13749 0 4096 4096
Flush 13749
Close 13749
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13750
ReadX 13750 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13750
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13751
ReadX 13751 0 4096 4096
Close 13751
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13752
ReadX 13752 0 4096 4096
Close 13752
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13753
ReadX 13753 0 4096 4096
WriteX 13753 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13754
Close 13754
Close 13753
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13755
Close 13755
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13757
WriteX 13757 4607 1 1
QUERY_FILE_INFORMATION 13757
WriteX 13757 0 65471 65471
WriteX 13757 65471 65 65
WriteX 13757 65536 9298 9298
Close 13757
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13758
ReadX 13758 0 4096 4096
WriteX 13758 0 4096 4096
Flush 13758
WriteX 13758 0 4096 4096
Flush 13758
Close 13758
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13759
Close 13759
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13760
ReadX 13760 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13761
Close 13761
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13763
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13763 0 4096 4096
Close 13763
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13764
ReadX 13764 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13764 4096 4096 4096
ReadX 13764 8192 4096 4096
ReadX 13764 12288 4096 4096
ReadX 13764 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13760
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13765
ReadX 13765 0 4096 4096
Close 13765
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13766
ReadX 13766 0 4096 4096
Close 13766
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13767
ReadX 13767 0 4096 4096
WriteX 13767 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13768
Close 13768
Close 13764
Close 13767
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13769
Close 13769
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13771
WriteX 13771 4607 1 1
QUERY_FILE_INFORMATION 13771
WriteX 13771 0 65471 65471
WriteX 13771 65471 65 65
WriteX 13771 65536 11540 11540
Close 13771
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13772
ReadX 13772 0 4096 4096
WriteX 13772 0 4096 4096
Flush 13772
WriteX 13772 0 4096 4096
Flush 13772
Close 13772
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13773
Close 13773
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13774
ReadX 13774 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13775
Close 13775
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13774
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13776
ReadX 13776 0 65471 65471
ReadX 13776 65471 65 65
ReadX 13776 65536 65471 65471
ReadX 13776 131007 65 65
ReadX 13776 131072 65471 65471
ReadX 13776 196543 65 65
ReadX 13776 196608 65471 65471
ReadX 13776 262079 65 65
ReadX 13776 262144 65471 65471
ReadX 13776 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13777
ReadX 13777 0 65471 65471
ReadX 13777 65471 65 65
ReadX 13777 65536 65471 65471
ReadX 13777 131007 65 65
ReadX 13777 131072 65471 65471
ReadX 13777 196543 65 65
ReadX 13777 196608 65471 65471
ReadX 13777 262079 65 65
ReadX 13777 262144 65471 65471
ReadX 13777 327615 65 65
ReadX 13777 327680 65471 65471
ReadX 13777 393151 65 65
ReadX 13777 393216 65471 65471
ReadX 13777 458687 65 65
ReadX 13777 458752 65471 65471
ReadX 13777 524223 65 65
ReadX 13777 524288 65471 65471
ReadX 13777 589759 65 65
ReadX 13777 589824 65471 65471
ReadX 13777 655295 65 65
ReadX 13777 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13778
ReadX 13778 0 65471 65471
ReadX 13778 65471 65 65
ReadX 13778 65536 65471 65471
ReadX 13778 131007 65 65
ReadX 13778 131072 65471 65471
ReadX 13778 196543 65 65
ReadX 13778 196608 65471 65471
ReadX 13778 262079 65 65
ReadX 13778 262144 65471 65471
ReadX 13778 327615 65 65
ReadX 13778 327680 65471 65471
ReadX 13778 393151 65 65
ReadX 13778 393216 65471 65471
ReadX 13778 458687 65 65
ReadX 13778 458752 65471 65471
ReadX 13778 524223 65 65
ReadX 13778 524288 65471 65471
ReadX 13778 589759 65 65
ReadX 13778 589824 65471 65471
ReadX 13778 655295 65 65
ReadX 13778 655360 65471 65471
ReadX 13778 720831 65 65
ReadX 13778 720896 65471 65471
ReadX 13778 786367 65 65
ReadX 13778 786432 65471 65471
ReadX 13778 851903 65 65
ReadX 13778 851968 65471 65471
ReadX 13778 917439 65 65
ReadX 13778 917504 65471 65471
ReadX 13778 982975 65 65
ReadX 13778 983040 65471 65471
ReadX 13778 1048511 65 65
ReadX 13778 1048576 65471 65471
ReadX 13778 1114047 65 65
ReadX 13778 1114112 65471 65471
ReadX 13778 1179583 65 65
ReadX 13778 1179648 65471 65471
ReadX 13778 1245119 65 65
ReadX 13778 1245184 65471 65471
ReadX 13778 1310655 65 65
ReadX 13778 1310720 65471 65471
ReadX 13778 1376191 65 65
ReadX 13778 1376256 65471 65471
ReadX 13778 1441727 65 65
ReadX 13778 1441792 65471 65471
ReadX 13778 1507263 65 65
ReadX 13778 1507328 65471 65471
ReadX 13778 1572799 65 65
ReadX 13778 1572864 65471 65471
ReadX 13778 1638335 65 65
ReadX 13778 1638400 65471 65471
ReadX 13778 1703871 65 65
ReadX 13778 1703936 65471 65471
ReadX 13778 1769407 65 65
ReadX 13778 1769472 65471 65471
ReadX 13778 1834943 65 65
ReadX 13778 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13779
FIND_FIRST \clients\client1\~dmtmp\*
Close 13779
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13780
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13781
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
ReadX 13781 2156 24 24
ReadX 13781 2139 276 276
ReadX 13781 2136 14 14
ReadX 13781 2136 7 7
ReadX 13781 2138 12 12
ReadX 13781 2137 8 8
ReadX 13781 2135 15 15
ReadX 13781 0 16 16
ReadX 13781 16 2048 2048
ReadX 13781 2064 2048 2048
ReadX 13781 257 2048 2048
ReadX 13781 385 2048 2048
ReadX 13781 513 2048 2048
ReadX 13781 641 2048 2048
ReadX 13781 769 2048 2048
ReadX 13781 897 2048 2048
ReadX 13781 1025 2048 2048
ReadX 13781 1153 2048 2048
ReadX 13781 1281 2048 2048
ReadX 13781 1409 2048 2048
ReadX 13781 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13783
Close 13783
Close 13729
Close 13776
Close 13777
Close 13778
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13785
WriteX 13785 15 1 1
QUERY_FILE_INFORMATION 13785
WriteX 13785 0 10575 10575
Flush 13785
Close 13785
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13786
Close 13786
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13787
ReadX 13787 0 4096 4096
Close 13781
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13788
Close 13788
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13789
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13790
QUERY_FILE_INFORMATION 13790
ReadX 13790 0 512 512
ReadX 13790 512 512 512
ReadX 13790 1024 512 512
QUERY_FILE_INFORMATION 13790
QUERY_FILE_INFORMATION 13790
Close 13790
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13791
QUERY_FILE_INFORMATION 13791
ReadX 13791 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13792
QUERY_FILE_INFORMATION 13792
ReadX 13792 0 512 512
ReadX 13792 512 512 512
ReadX 13792 1024 512 512
ReadX 13792 288 20 20
ReadX 13792 308 2084 2084
ReadX 13792 388 2084 2084
ReadX 13792 388 2084 2084
ReadX 13780 2157 1386 1386
ReadX 13792 2472 399 399
ReadX 13792 3072 1536 1536
ReadX 13792 544 149 149
ReadX 13792 693 485 485
Close 13792
ReadX 13780 2157 4096 4096
ReadX 13780 6253 4096 4096
ReadX 13780 10349 4096 4096
ReadX 13780 14445 4096 4096
ReadX 13780 18541 4096 4096
ReadX 13780 22637 256 256
ReadX 13780 22893 4096 4096
ReadX 13780 26989 4096 4096
ReadX 13780 31085 4096 4096
ReadX 13780 35181 4096 4096
ReadX 13780 39277 4096 4096
ReadX 13780 43373 4096 4096
ReadX 13780 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13780 2157 1024 1024
ReadX 13780 1667 4688 4688
ReadX 13780 6355 3516 3516
ReadX 13780 9871 16384 16384
ReadX 13780 26255 3771 3771
ReadX 13780 30026 2048 2048
ReadX 13780 32074 1024 1024
ReadX 13780 33098 6652 6652
ReadX 13780 39750 16384 16384
ReadX 13780 56134 10496 10496
ReadX 13780 66630 1784 1784
ReadX 13780 68414 90 90
ReadX 13780 68504 273 273
ReadX 13780 68777 1600 1600
ReadX 13780 70377 640 640
ReadX 13780 71017 1280 1280
ReadX 13780 72297 8464 8464
ReadX 13780 80761 158 158
ReadX 13780 80919 912 912
ReadX 13780 81831 1980 1980
ReadX 13780 83811 2256 2256
ReadX 13780 86067 400 400
ReadX 13780 86467 252 252
ReadX 13780 86719 42 42
ReadX 13780 86761 725 725
ReadX 13780 2009 512 512
ReadX 13780 3895 9 9
ReadX 13780 3781 46 46
ReadX 13780 4059 92 92
ReadX 13780 3781 92 92
ReadX 13780 3986 184 184
ReadX 13780 3987 16384 16384
ReadX 13780 3902 16384 16384
ReadX 13780 3781 10240 10240
ReadX 13780 3821 16384 16384
ReadX 13780 3891 935 935
ReadX 13780 4060 10240 10240
ReadX 13780 4059 184 184
ReadX 13780 256 184 184
ReadX 13780 256 1026 1026
ReadX 13780 3901 326 326
ReadX 13780 3899 652 652
ReadX 13780 256 2 2
ReadX 13780 258 4948 4948
Close 13780
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13794
Close 13794
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13796
WriteX 13796 4055 1 1
QUERY_FILE_INFORMATION 13796
WriteX 13796 0 65471 65471
WriteX 13796 65471 65 65
WriteX 13796 65536 65471 65471
WriteX 13796 131007 65 65
WriteX 13796 131072 65471 65471
WriteX 13796 196543 65 65
WriteX 13796 196608 65471 65471
WriteX 13796 262079 65 65
WriteX 13796 262144 65471 65471
WriteX 13796 327615 65 65
WriteX 13796 327680 65471 65471
WriteX 13796 393151 65 65
WriteX 13796 393216 65471 65471
WriteX 13796 458687 65 65
WriteX 13796 458752 65471 65471
WriteX 13796 524223 65 65
WriteX 13796 524288 65471 65471
WriteX 13796 589759 65 65
WriteX 13796 589824 35257 35257
Close 13796
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13798
Close 13798
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13800
WriteX 13800 4055 1 1
QUERY_FILE_INFORMATION 13800
WriteX 13800 0 65471 65471
WriteX 13800 65471 65 65
WriteX 13800 65536 65471 65471
WriteX 13800 131007 65 65
WriteX 13800 131072 65471 65471
WriteX 13800 196543 65 65
WriteX 13800 196608 65471 65471
WriteX 13800 262079 65 65
WriteX 13800 262144 65471 65471
WriteX 13800 327615 65 65
WriteX 13800 327680 65471 65471
WriteX 13800 393151 65 65
WriteX 13800 393216 65471 65471
WriteX 13800 458687 65 65
WriteX 13800 458752 65471 65471
WriteX 13800 524223 65 65
WriteX 13800 524288 65471 65471
WriteX 13800 589759 65 65
WriteX 13800 589824 57598 57598
Close 13800
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13802
WriteX 13802 15 1 1
QUERY_FILE_INFORMATION 13802
WriteX 13802 0 12543 12543
Flush 13802
Close 13802
Close 13787
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13803
Close 13803
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13804
ReadX 13804 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13805
FIND_FIRST \clients\client1\~dmtmp\*
Close 13805
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13806
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13807
QUERY_FILE_INFORMATION 13807
QUERY_FILE_INFORMATION 13807
QUERY_FILE_INFORMATION 13807
ReadX 13807 1938 24 24
ReadX 13807 1920 276 276
ReadX 13807 1918 14 14
ReadX 13807 1918 7 7
ReadX 13807 1919 12 12
ReadX 13807 1919 8 8
ReadX 13807 1917 15 15
ReadX 13807 0 16 16
ReadX 13807 16 2048 2048
ReadX 13807 2064 2048 2048
ReadX 13807 257 2048 2048
ReadX 13807 385 2048 2048
ReadX 13807 513 2048 2048
ReadX 13807 641 2048 2048
ReadX 13807 769 2048 2048
ReadX 13807 897 2048 2048
ReadX 13807 1025 2048 2048
ReadX 13807 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13809
Close 13809
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13811
WriteX 13811 15 1 1
QUERY_FILE_INFORMATION 13811
WriteX 13811 0 11588 11588
Flush 13811
Close 13811
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13812
Close 13812
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13813
ReadX 13813 0 4096 4096
Close 13807
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13815
WriteX 13815 15 1 1
QUERY_FILE_INFORMATION 13815
WriteX 13815 0 11615 11615
Flush 13815
Close 13815
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13813
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13816
Close 13816
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13817
ReadX 13817 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13819
Close 13819
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13821
WriteX 13821 4088 1 1
QUERY_FILE_INFORMATION 13821
WriteX 13821 0 65471 65471
WriteX 13821 65471 65 65
WriteX 13821 65536 16050 16050
Close 13821
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13806 1939 64 64
ReadX 13806 128 248 248
ReadX 13806 128 568 568
ReadX 13806 3872 1536 1536
ReadX 13806 3456 2560 2560
ReadX 13806 3136 512 512
ReadX 13806 2880 4096 4096
ReadX 13806 3264 3072 3072
ReadX 13806 320 4096 4096
ReadX 13806 1024 4096 4096
ReadX 13806 3616 4096 4096
ReadX 13806 1939 64 64
ReadX 13806 128 248 248
ReadX 13806 128 608 608
ReadX 13806 2858 1024 1024
ReadX 13806 2810 4096 4096
ReadX 13806 2826 4096 4096
ReadX 13806 2580 2048 2048
ReadX 13806 2800 2560 2560
ReadX 13806 2100 4096 4096
ReadX 13806 2084 4096 4096
ReadX 13806 868 4096 4096
ReadX 13806 2324 4096 4096
ReadX 13806 884 4096 4096
ReadX 13806 2604 1024 1024
ReadX 13806 580 4096 4096
ReadX 13806 596 4096 4096
ReadX 13806 2752 4096 4096
ReadX 13806 2842 1024 1024
ReadX 13806 660 4096 4096
ReadX 13806 2720 4096 4096
ReadX 13806 2736 4096 4096
ReadX 13806 628 4096 4096
ReadX 13806 2704 4096 4096
ReadX 13806 1556 4096 4096
ReadX 13806 576 4096 4096
ReadX 13806 3168 1536 1536
ReadX 13806 832 4096 4096
ReadX 13806 1088 4096 4096
ReadX 13806 1344 4096 4096
ReadX 13806 1600 4096 4096
ReadX 13806 1856 4096 4096
ReadX 13806 2112 4096 4096
ReadX 13806 1892 4096 4096
ReadX 13806 820 4096 4096
ReadX 13806 788 4096 4096
ReadX 13806 1604 4096 4096
ReadX 13806 3648 4096 4096
ReadX 13806 2608 4096 4096
ReadX 13806 548 4096 4096
ReadX 13806 740 4096 4096
ReadX 13806 1344 4096 4096
ReadX 13806 3392 4096 4096
ReadX 13806 3904 4096 4096
ReadX 13806 644 4096 4096
ReadX 13806 676 4096 4096
ReadX 13806 2688 4096 4096
ReadX 13806 320 4096 4096
ReadX 13806 900 4096 4096
ReadX 13806 1908 4096 4096
ReadX 13806 852 4096 4096
ReadX 13806 724 4096 4096
ReadX 13806 2292 4096 4096
ReadX 13806 612 4096 4096
ReadX 13806 388 4096 4096
ReadX 13806 2368 4096 4096
ReadX 13806 2624 4096 4096
ReadX 13806 500 4096 4096
ReadX 13806 356 4096 4096
ReadX 13806 1024 4096 4096
ReadX 13806 576 4096 4096
ReadX 13806 340 4096 4096
ReadX 13806 420 4096 4096
ReadX 13806 1600 4096 4096
ReadX 13806 404 4096 4096
ReadX 13806 1428 4096 4096
ReadX 13806 2656 4096 4096
ReadX 13806 2624 4096 4096
ReadX 13806 452 4096 4096
ReadX 13806 692 4096 4096
ReadX 13806 564 4096 4096
ReadX 13806 372 4096 4096
ReadX 13806 468 4096 4096
ReadX 13806 484 4096 4096
ReadX 13806 1088 4096 4096
ReadX 13806 1924 4096 4096
ReadX 13806 2768 4096 4096
ReadX 13806 832 4096 4096
ReadX 13806 836 4096 4096
ReadX 13806 1856 4096 4096
ReadX 13806 2640 4096 4096
ReadX 13806 436 4096 4096
ReadX 13806 1828 4096 4096
ReadX 13806 804 4096 4096
ReadX 13806 1860 4096 4096
ReadX 13806 1812 4096 4096
ReadX 13806 756 4096 4096
ReadX 13806 1636 4096 4096
ReadX 13806 772 4096 4096
ReadX 13806 2036 4096 4096
ReadX 13806 1220 4096 4096
ReadX 13806 1652 4096 4096
ReadX 13806 2588 4096 4096
ReadX 13806 916 4096 4096
ReadX 13806 260 4096 4096
ReadX 13806 932 4096 4096
ReadX 13806 2624 4096 4096
ReadX 13806 308 4096 4096
ReadX 13806 292 4096 4096
ReadX 13806 1140 4096 4096
ReadX 13806 276 4096 4096
ReadX 13806 2020 4096 4096
ReadX 13806 2880 4096 4096
ReadX 13806 516 4096 4096
ReadX 13806 1844 4096 4096
ReadX 13806 1124 4096 4096
ReadX 13806 3136 4096 4096
ReadX 13806 324 4096 4096
ReadX 13806 1156 4096 4096
ReadX 13806 1172 4096 4096
ReadX 13806 2112 4096 4096
ReadX 13806 2368 4096 4096
ReadX 13806 964 4096 4096
ReadX 13806 980 4096 4096
ReadX 13806 1012 4096 4096
ReadX 13806 532 4096 4096
ReadX 13806 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13806 1620 4096 4096
ReadX 13806 1604 4096 4096
ReadX 13806 2116 4096 4096
ReadX 13806 2132 4096 4096
ReadX 13806 2148 4096 4096
ReadX 13806 2276 4096 4096
ReadX 13806 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13823
Close 13823
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13825
QUERY_FILE_INFORMATION 13789
Close 13789
WriteX 13825 4088 1 1
QUERY_FILE_INFORMATION 13825
QUERY_FILE_INFORMATION 13791
Close 13791
WriteX 13825 0 65471 65471
WriteX 13825 65471 65 65
WriteX 13825 65536 64850 64850
Close 13825
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13827
WriteX 13827 15 1 1
QUERY_FILE_INFORMATION 13827
ReadX 13806 2068 4096 4096
ReadX 13806 1588 4096 4096
ReadX 13806 1572 4096 4096
WriteX 13827 0 18630 18630
Flush 13827
Close 13827
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13817
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13828
Close 13828
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13829
ReadX 13829 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13806 612 4096 4096
ReadX 13806 564 4096 4096
ReadX 13806 1876 4096 4096
ReadX 13806 628 4096 4096
ReadX 13806 740 4096 4096
ReadX 13806 724 4096 4096
ReadX 13806 644 4096 4096
ReadX 13806 2324 4096 4096
ReadX 13806 660 4096 4096
ReadX 13806 852 4096 4096
ReadX 13806 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13806 2368 4096 4096
ReadX 13806 1024 4096 4096
ReadX 13806 320 4096 4096
ReadX 13806 580 4096 4096
ReadX 13806 3136 512 512
ReadX 13806 2880 4096 4096
Close 13806
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13830
ReadX 13830 61440 4096 4096
ReadX 13830 126976 4096 4096
WriteX 13830 0 65471 65471
WriteX 13830 65471 65 65
WriteX 13830 65536 65471 65471
WriteX 13830 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13831
ReadX 13831 61440 4096 4096
ReadX 13831 126976 4096 4096
ReadX 13831 192512 4096 4096
ReadX 13831 258048 4096 4096
WriteX 13831 0 65471 65471
WriteX 13831 65471 65 65
WriteX 13831 65536 65471 65471
WriteX 13831 131007 65 65
WriteX 13831 131072 65471 65471
WriteX 13831 196543 65 65
WriteX 13831 196608 65471 65471
WriteX 13831 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13832
ReadX 13832 61440 4096 4096
ReadX 13832 126976 4096 4096
ReadX 13832 192512 4096 4096
ReadX 13832 258048 4096 4096
ReadX 13832 323584 4096 4096
ReadX 13832 389120 4096 4096
ReadX 13832 454656 4096 4096
ReadX 13832 520192 4096 4096
WriteX 13832 0 65471 65471
WriteX 13832 65471 65 65
WriteX 13832 65536 65471 65471
WriteX 13832 131007 65 65
WriteX 13832 131072 65471 65471
WriteX 13832 196543 65 65
WriteX 13832 196608 65471 65471
WriteX 13832 262079 65 65
WriteX 13832 262144 65471 65471
WriteX 13832 327615 65 65
WriteX 13832 327680 65471 65471
WriteX 13832 393151 65 65
WriteX 13832 393216 65471 65471
WriteX 13832 458687 65 65
WriteX 13832 458752 65471 65471
WriteX 13832 524223 65 65
Close 13829
Close 13804
Close 13830
Close 13831
Close 13832
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13833
Close 13833
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13834
Close 13834
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13837
Close 13837
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13839
Close 13839
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13840
Close 13840
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13843
Close 13843
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13845
Close 13845
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13846
Close 13846
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13849
Close 13849
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13853
Close 13853
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13857
Close 13857
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13861
Close 13861
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13865
Close 13865
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13869
Close 13869
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13873
Close 13873
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13877
Close 13877
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13879
Close 13879
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13881
Close 13881
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13883
WriteX 13883 4095 1 1
QUERY_FILE_INFORMATION 13883
QUERY_FS_INFORMATION 259
WriteX 13883 0 65471 65471
WriteX 13883 65471 65 65
WriteX 13883 65536 65471 65471
WriteX 13883 131007 65 65
WriteX 13883 131072 65471 65471
WriteX 13883 196543 65 65
WriteX 13883 196608 65471 65471
WriteX 13883 262079 65 65
WriteX 13883 262144 26634 26634
Close 13883
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13888
Close 13888
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13889
Close 13889
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13890
ReadX 13890 0 4096 4096
Close 13890
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13891
ReadX 13891 0 4096 4096
ReadX 13891 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13892
Close 13892
Close 13891
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13895
Close 13895
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13897
Close 13897
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13898
Close 13898
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13901
Close 13901
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13903
Close 13903
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13904
Close 13904
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13907
Close 13907
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13911
Close 13911
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13915
Close 13915
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13919
Close 13919
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13923
Close 13923
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13927
Close 13927
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13930
Close 13930
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13934
Close 13934
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13938
Close 13938
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13940
Close 13940
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13941
Close 13941
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13950
Close 13950
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13951
FIND_FIRST \clients\client1\~dmtmp\*
Close 13951
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13952
Close 13952
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13953
ReadX 13953 0 4096 4096
Close 13953
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13954
ReadX 13954 0 4096 4096
Close 13954
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13955
ReadX 13955 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13965
Close 13965
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13966
FIND_FIRST \clients\client1\~dmtmp\*
Close 13966
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13967
Close 13967
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13968
ReadX 13968 0 4096 4096
Close 13968
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13969
ReadX 13969 0 4096 4096
Close 13969
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13970
ReadX 13970 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13971
ReadX 13971 0 65471 65471
ReadX 13971 65471 65 65
ReadX 13971 65536 65471 65471
ReadX 13971 131007 65 65
ReadX 13971 131072 65471 65471
ReadX 13971 196543 65 65
ReadX 13971 196608 65471 65471
ReadX 13971 262079 65 65
ReadX 13971 262144 65471 65471
ReadX 13971 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13972
ReadX 13972 0 65471 65471
ReadX 13972 65471 65 65
ReadX 13972 65536 65471 65471
ReadX 13972 131007 65 65
ReadX 13972 131072 65471 65471
ReadX 13972 196543 65 65
ReadX 13972 196608 65471 65471
ReadX 13972 262079 65 65
ReadX 13972 262144 65471 65471
ReadX 13972 327615 65 65
ReadX 13972 327680 65471 65471
ReadX 13972 393151 65 65
ReadX 13972 393216 65471 65471
ReadX 13972 458687 65 65
ReadX 13972 458752 65471 65471
ReadX 13972 524223 65 65
ReadX 13972 524288 65471 65471
ReadX 13972 589759 65 65
ReadX 13972 589824 65471 65471
ReadX 13972 655295 65 65
ReadX 13972 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13973
ReadX 13973 0 65471 65471
ReadX 13973 65471 65 65
ReadX 13973 65536 65471 65471
ReadX 13973 131007 65 65
ReadX 13973 131072 65471 65471
ReadX 13973 196543 65 65
ReadX 13973 196608 65471 65471
ReadX 13973 262079 65 65
ReadX 13973 262144 65471 65471
ReadX 13973 327615 65 65
ReadX 13973 327680 65471 65471
ReadX 13973 393151 65 65
ReadX 13973 393216 65471 65471
ReadX 13973 458687 65 65
ReadX 13973 458752 65471 65471
ReadX 13973 524223 65 65
ReadX 13973 524288 65471 65471
ReadX 13973 589759 65 65
ReadX 13973 589824 65471 65471
ReadX 13973 655295 65 65
ReadX 13973 655360 65471 65471
ReadX 13973 720831 65 65
ReadX 13973 720896 65471 65471
ReadX 13973 786367 65 65
ReadX 13973 786432 65471 65471
ReadX 13973 851903 65 65
ReadX 13973 851968 65471 65471
ReadX 13973 917439 65 65
ReadX 13973 917504 65471 65471
ReadX 13973 982975 65 65
ReadX 13973 983040 65471 65471
ReadX 13973 1048511 65 65
ReadX 13973 1048576 65471 65471
ReadX 13973 1114047 65 65
ReadX 13973 1114112 65471 65471
ReadX 13973 1179583 65 65
ReadX 13973 1179648 65471 65471
ReadX 13973 1245119 65 65
ReadX 13973 1245184 65471 65471
ReadX 13973 1310655 65 65
ReadX 13973 1310720 65471 65471
ReadX 13973 1376191 65 65
ReadX 13973 1376256 65471 65471
ReadX 13973 1441727 65 65
ReadX 13973 1441792 65471 65471
ReadX 13973 1507263 65 65
ReadX 13973 1507328 65471 65471
ReadX 13973 1572799 65 65
ReadX 13973 1572864 65471 65471
ReadX 13973 1638335 65 65
ReadX 13973 1638400 65471 65471
ReadX 13973 1703871 65 65
ReadX 13973 1703936 65471 65471
ReadX 13973 1769407 65 65
ReadX 13973 1769472 65471 65471
ReadX 13973 1834943 65 65
ReadX 13973 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13974
ReadX 13974 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13974 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13974 8192 4096 4096
ReadX 13974 12288 4096 4096
ReadX 13974 16384 4096 4096
ReadX 13974 20480 4096 4096
ReadX 13974 24576 4096 4096
ReadX 13974 28672 4096 4096
ReadX 13974 32768 4096 4096
ReadX 13974 36864 4096 4096
ReadX 13974 40960 4096 4096
ReadX 13974 45056 4096 4096
ReadX 13974 49152 4096 4096
ReadX 13974 53248 4096 4096
ReadX 13974 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13974 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13975
Close 13975
Close 13955
Close 13970
Close 13971
Close 13972
Close 13973
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13976
WriteX 13976 1535 1 1
QUERY_FILE_INFORMATION 13976
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13974 0 4096 4096
ReadX 13974 4096 4096 4096
QUERY_FILE_INFORMATION 13976
WriteX 13976 0 57088 57088
WriteX 13976 0 4096 4096
Flush 13976
Close 13974
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13977
Close 13977
WriteX 13976 0 4096 4096
Close 13976
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13978
Close 13978
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13979
ReadX 13979 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13979 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13980
WriteX 13980 1535 1 1
QUERY_FILE_INFORMATION 13980
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13979 0 4096 4096
QUERY_FILE_INFORMATION 13980
WriteX 13980 0 51456 51456
WriteX 13980 0 4096 4096
Flush 13980
Close 13979
WriteX 13980 0 4096 4096
Close 13980
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13981
Close 13981
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13982
ReadX 13982 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13982 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13984
Close 13984
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13986
WriteX 13986 4045 1 1
QUERY_FILE_INFORMATION 13986
WriteX 13986 0 53077 53077
Close 13986
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13987
WriteX 13987 1535 1 1
QUERY_FILE_INFORMATION 13987
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13982 0 4096 4096
QUERY_FILE_INFORMATION 13987
WriteX 13987 0 65471 65471
WriteX 13987 65471 65 65
WriteX 13987 65536 1856 1856
WriteX 13987 0 4096 4096
Flush 13987
Close 13982
WriteX 13987 0 4096 4096
Close 13987
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13988
Close 13988
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13989
ReadX 13989 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13991
Close 13991
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13993
WriteX 13993 4076 1 1
QUERY_FILE_INFORMATION 13993
WriteX 13993 0 7983 7983
Close 13993
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13995
Close 13995
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13997
WriteX 13997 4095 1 1
QUERY_FILE_INFORMATION 13997
WriteX 13997 0 65471 65471
WriteX 13997 65471 65 65
WriteX 13997 65536 65471 65471
WriteX 13997 131007 65 65
WriteX 13997 131072 65471 65471
WriteX 13997 196543 65 65
WriteX 13997 196608 65471 65471
WriteX 13997 262079 65 65
WriteX 13997 262144 65471 65471
WriteX 13997 327615 65 65
WriteX 13997 327680 65471 65471
WriteX 13997 393151 65 65
WriteX 13997 393216 65471 65471
WriteX 13997 458687 65 65
WriteX 13997 458752 46731 46731
Close 13997
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13998
WriteX 13998 1535 1 1
QUERY_FILE_INFORMATION 13998
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13989 0 4096 4096
ReadX 13989 4096 4096 4096
QUERY_FILE_INFORMATION 13998
WriteX 13998 0 65471 65471
WriteX 13998 65471 65 65
WriteX 13998 65536 22848 22848
WriteX 13998 0 4096 4096
Flush 13998
Close 13989
WriteX 13998 0 4096 4096
Close 13998
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13999
Close 13999
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14000
ReadX 14000 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14000 4096 4096 4096
Close 14000
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14001
ReadX 14001 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14001 0 8192 8192
ReadX 14001 8192 4096 4096
ReadX 14001 12288 4096 4096
ReadX 14001 16384 4096 4096
ReadX 14001 20480 4096 4096
ReadX 14001 24576 4096 4096
ReadX 14001 28672 4096 4096
ReadX 14001 32768 4096 4096
ReadX 14001 36864 4096 4096
ReadX 14001 40960 4096 4096
ReadX 14001 45056 4096 4096
ReadX 14001 49152 4096 4096
ReadX 14001 53248 4096 4096
ReadX 14001 57344 4096 4096
ReadX 14001 61440 4096 4096
ReadX 14001 65536 4096 4096
ReadX 14001 69632 4096 4096
ReadX 14001 73728 4096 4096
ReadX 14001 77824 4096 4096
ReadX 14001 81920 4096 4096
ReadX 14001 86016 4096 4096
ReadX 14001 90112 4096 4096
ReadX 14001 94208 4096 4096
ReadX 14001 98304 4096 4096
ReadX 14001 102400 4096 4096
ReadX 14001 106496 4096 4096
ReadX 14001 110592 4096 4096
ReadX 14001 114688 4096 4096
ReadX 14001 118784 4096 4096
ReadX 14001 122880 4096 4096
ReadX 14001 126976 4096 4096
ReadX 14001 131072 4096 4096
ReadX 14001 135168 4096 4096
ReadX 14001 139264 4096 4096
ReadX 14001 143360 4096 4096
ReadX 14001 147456 4096 4096
ReadX 14001 151552 4096 4096
ReadX 14001 155648 4096 4096
ReadX 14001 159744 4096 4096
ReadX 14001 163840 4096 4096
ReadX 14001 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 14001 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 14002
Close 14002
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 14003
WriteX 14003 2047 1 1
QUERY_FILE_INFORMATION 14003
Close 14001
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14004
Close 14004
WriteX 14003 0 42388 42388
Close 14003
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 14005
Close 14005
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 14006
ReadX 14006 0 4096 4096
ReadX 14006 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 14007
WriteX 14007 2047 1 1
QUERY_FILE_INFORMATION 14007
Close 14006
WriteX 14007 0 42652 42652
Close 14007
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 14008
Close 14008
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 14009
ReadX 14009 0 4096 4096
ReadX 14009 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14011
Close 14011
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14013
WriteX 14013 4080 1 1
QUERY_FILE_INFORMATION 14013
WriteX 14013 0 65471 65471
WriteX 14013 65471 65 65
WriteX 14013 65536 49 49
Close 14013
Close 14009
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14014
ReadX 14014 61440 4096 4096
ReadX 14014 126976 4096 4096
WriteX 14014 0 65471 65471
WriteX 14014 65471 65 65
WriteX 14014 65536 65471 65471
WriteX 14014 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14015
ReadX 14015 61440 4096 4096
ReadX 14015 126976 4096 4096
ReadX 14015 192512 4096 4096
ReadX 14015 258048 4096 4096
WriteX 14015 0 65471 65471
WriteX 14015 65471 65 65
WriteX 14015 65536 65471 65471
WriteX 14015 131007 65 65
WriteX 14015 131072 65471 65471
WriteX 14015 196543 65 65
WriteX 14015 196608 65471 65471
WriteX 14015 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14016
ReadX 14016 61440 4096 4096
ReadX 14016 126976 4096 4096
ReadX 14016 192512 4096 4096
ReadX 14016 258048 4096 4096
ReadX 14016 323584 4096 4096
ReadX 14016 389120 4096 4096
ReadX 14016 454656 4096 4096
ReadX 14016 520192 4096 4096
WriteX 14016 0 65471 65471
WriteX 14016 65471 65 65
WriteX 14016 65536 65471 65471
WriteX 14016 131007 65 65
WriteX 14016 131072 65471 65471
WriteX 14016 196543 65 65
WriteX 14016 196608 65471 65471
WriteX 14016 262079 65 65
WriteX 14016 262144 65471 65471
WriteX 14016 327615 65 65
WriteX 14016 327680 65471 65471
WriteX 14016 393151 65 65
WriteX 14016 393216 65471 65471
WriteX 14016 458687 65 65
WriteX 14016 458752 65471 65471
WriteX 14016 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14017
FIND_FIRST \clients\client1\~dmtmp\*
Close 14017
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14018
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14018 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14019
ReadX 14019 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14020
ReadX 14020 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14021
ReadX 14021 0 4096 4096
ReadX 14018 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14018
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14022
ReadX 14022 0 4096 4096
ReadX 14022 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 14023
FIND_FIRST \clients\client1\~dmtmp\*
Close 14023
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 14024
QUERY_FILE_INFORMATION 14024
WriteX 14024 2047 1 1
QUERY_FILE_INFORMATION 14024
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 14025
Close 14025
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 14026
WriteX 14026 52 1 1
QUERY_FILE_INFORMATION 14026
WriteX 14026 0 491 491
Close 14026
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 14027
ReadX 14027 0 491 491
WriteX 14024 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 14022
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14028
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14028 0 4096 4096
ReadX 14028 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 14030
Close 14030
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14031
WriteX 14031 52 1 1
QUERY_FILE_INFORMATION 14031
WriteX 14031 0 543 543
Close 14031
Close 14028
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14032
ReadX 14032 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14033
ReadX 14033 0 543 543
ReadX 14032 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14032
Close 14027
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 14014
Close 14015
Close 14016
Close 14033
Close 14019
Close 14020
Close 14021
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 14024
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14034
FIND_FIRST \clients\client1\~dmtmp\*
Close 14034
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14035
ReadX 14035 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14036
ReadX 14036 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14037
ReadX 14037 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14038
ReadX 14038 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14039
ReadX 14039 0 543 543
ReadX 14035 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 14043
FIND_FIRST \clients\client1\~dmtmp\*
Close 14043
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14044
QUERY_FILE_INFORMATION 14044
WriteX 14044 2047 1 1
QUERY_FILE_INFORMATION 14044
WriteX 14044 0 2048 2048
Close 14044
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14045
ReadX 14045 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 14045
Close 14035
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14046
ReadX 14046 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 14046 4095 1 1
QUERY_FILE_INFORMATION 14046
ReadX 14046 0 4096 4096
WriteX 14046 0 4096 4096
Flush 14046
WriteX 14046 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14047
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14047 0 4096 4096
ReadX 14047 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 14051
FIND_FIRST \clients\client1\~dmtmp\*
Close 14051
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14052
WriteX 14052 2047 1 1
QUERY_FILE_INFORMATION 14052
WriteX 14052 0 2048 2048
Close 14052
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14053
ReadX 14053 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 14057
Close 14057
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14058
WriteX 14058 2047 1 1
QUERY_FILE_INFORMATION 14058
WriteX 14058 0 2048 2048
Close 14058
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14059
ReadX 14059 0 2048 2048
ReadX 14047 4096 16384 16384
Close 14059
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14060
ReadX 14060 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 14060
Close 14039
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 14053 4095 1 1
QUERY_FILE_INFORMATION 14053
ReadX 14053 0 4096 4096
WriteX 14053 0 4096 4096
Close 14053
WriteX 14047 0 8192 8192
Close 14047
WriteX 14036 0 4096 4096
WriteX 14037 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14062
ReadX 14062 0 4096 4096
ReadX 14062 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14062
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14063
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14063 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14064
ReadX 14064 0 543 543
ReadX 14063 0 4096 4096
Close 14063
Close 14046
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14065
QUERY_FILE_INFORMATION 14065
Close 14065
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 14064
Close 14036
Close 14037
Close 14038
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14066
FIND_FIRST \clients\client1\~dmtmp\*
Close 14066
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14067
ReadX 14067 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14068
ReadX 14068 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14069
ReadX 14069 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14070
ReadX 14070 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14071
ReadX 14071 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14072
ReadX 14072 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14073
ReadX 14073 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 14074
ReadX 14074 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14075
ReadX 14075 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 14076
ReadX 14076 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 14077
ReadX 14077 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 14078
ReadX 14078 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 14079
ReadX 14079 0 4096 4096
ReadX 14067 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 14083
FIND_FIRST \clients\client1\~dmtmp\*
Close 14083
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 14084
QUERY_FILE_INFORMATION 14084
WriteX 14084 2047 1 1
QUERY_FILE_INFORMATION 14084
WriteX 14084 0 2048 2048
Close 14084
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 14085
ReadX 14085 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 14085
Close 14075
Close 14067
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 14086
ReadX 14086 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14087
FIND_FIRST \clients\client1\~dmtmp\*
Close 14087
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14088
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14088 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14089
ReadX 14089 0 4096 4096
ReadX 14088 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 14093
FIND_FIRST \clients\client1\~dmtmp\*
Close 14093
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 14094
QUERY_FILE_INFORMATION 14094
WriteX 14094 2047 1 1
QUERY_FILE_INFORMATION 14094
WriteX 14094 0 2048 2048
Close 14094
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 14095
ReadX 14095 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 14095
Close 14088
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12481
ReadX 12481 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 14086 4095 1 1
QUERY_FILE_INFORMATION 14086
ReadX 14086 0 4096 4096
WriteX 14086 0 4096 4096
Flush 14086
WriteX 12481 4095 1 1
QUERY_FILE_INFORMATION 12481
ReadX 12481 0 4096 4096
WriteX 12481 0 4096 4096
Flush 12481
WriteX 14086 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 12481 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12482
ReadX 12482 0 4096 4096
ReadX 14089 0 4096 4096
ReadX 12482 0 4096 4096
ReadX 12482 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12483
FIND_FIRST \clients\client1\~dmtmp\*
Close 12483
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12484
WriteX 12484 4095 1 1
QUERY_FILE_INFORMATION 12484
WriteX 12484 0 4096 4096
Close 12484
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12485
ReadX 12485 0 4096 4096
Close 12482
Close 14089
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12486
Close 12486
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12487
WriteX 12487 4095 1 1
QUERY_FILE_INFORMATION 12487
WriteX 12487 0 4096 4096
Close 12487
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12488
ReadX 12488 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 12488 0 4096 4096
Close 12485
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 14079
Close 14073
Close 14076
Close 14077
Close 14078
Close 14074
Close 14068
Close 14071
Close 14072
Close 14069
Close 14070
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12488
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12490
Close 12490
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12491
ReadX 12491 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12492
Close 12492
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12493
WriteX 12493 2047 1 1
QUERY_FILE_INFORMATION 12493
WriteX 12493 0 2048 2048
Close 12493
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12494
ReadX 12494 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12494
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12495
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12495 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12496
ReadX 12496 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12497
ReadX 12497 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12498
ReadX 12498 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12499
ReadX 12499 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12500
ReadX 12500 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12501
ReadX 12501 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12502
ReadX 12502 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12503
ReadX 12503 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12504
ReadX 12504 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12505
ReadX 12505 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12506
ReadX 12506 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12507
ReadX 12507 0 4096 4096
ReadX 12495 0 4096 4096
ReadX 12502 0 4096 4096
Close 12502
Close 12495
Close 14086
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12508
QUERY_FILE_INFORMATION 12508
Close 12508
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12491
Close 12506
Close 12501
Close 12503
Close 12504
Close 12505
Close 12507
Close 12496
Close 12499
Close 12500
Close 12497
Close 12498
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12481
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12509
QUERY_FILE_INFORMATION 12509
Close 12509
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12510
FIND_FIRST \clients\client1\~dmtmp\*
Close 12510
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12511
ReadX 12511 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12512
ReadX 12512 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12513
ReadX 12513 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12514
ReadX 12514 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12515
ReadX 12515 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12516
ReadX 12516 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12517
ReadX 12517 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12518
ReadX 12518 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12519
ReadX 12519 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12520
ReadX 12520 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12521
ReadX 12521 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12522
ReadX 12522 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12523
ReadX 12523 0 4096 4096
ReadX 12511 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12527
FIND_FIRST \clients\client1\~dmtmp\*
Close 12527
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12528
QUERY_FILE_INFORMATION 12528
WriteX 12528 2047 1 1
QUERY_FILE_INFORMATION 12528
WriteX 12528 0 2048 2048
Close 12528
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12529
ReadX 12529 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12529
Close 12511
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12530
ReadX 12530 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12531
FIND_FIRST \clients\client1\~dmtmp\*
Close 12531
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12532
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12532 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12533
ReadX 12533 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12534
ReadX 12534 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12535
ReadX 12535 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12536
ReadX 12536 0 543 543
ReadX 12532 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12540
FIND_FIRST \clients\client1\~dmtmp\*
Close 12540
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12541
QUERY_FILE_INFORMATION 12541
WriteX 12541 2047 1 1
QUERY_FILE_INFORMATION 12541
WriteX 12541 0 2048 2048
Close 12541
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12542
ReadX 12542 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12542
Close 12532
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12543
ReadX 12543 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 12516
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12544
FIND_FIRST \clients\client1\~dmtmp\*
Close 12544
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12545
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12545 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12546
ReadX 12546 0 4096 4096
ReadX 12545 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12550
FIND_FIRST \clients\client1\~dmtmp\*
Close 12550
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12551
QUERY_FILE_INFORMATION 12551
WriteX 12551 2047 1 1
QUERY_FILE_INFORMATION 12551
WriteX 12551 0 2048 2048
Close 12551
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12552
ReadX 12552 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12552
Close 12546
Close 12545
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12553
ReadX 12553 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12530 4095 1 1
QUERY_FILE_INFORMATION 12530
ReadX 12530 0 4096 4096
WriteX 12530 0 4096 4096
Flush 12530
WriteX 12543 4095 1 1
QUERY_FILE_INFORMATION 12543
ReadX 12543 0 4096 4096
WriteX 12543 0 4096 4096
Flush 12543
WriteX 12553 4095 1 1
QUERY_FILE_INFORMATION 12553
ReadX 12553 0 4096 4096
WriteX 12553 0 4096 4096
Flush 12553
WriteX 12530 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 12543 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 12553 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12554
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12554 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12555
ReadX 12555 0 4096 4096
ReadX 12554 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12556
ReadX 12556 0 4096 4096
ReadX 12556 0 4096 4096
ReadX 12556 4096 16384 16384
ReadX 12554 4096 16384 16384
ReadX 12554 0 4096 4096
ReadX 12555 0 4096 4096
ReadX 12555 4096 4096 4096
Close 12556
Close 12555
Close 12554
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12557
FIND_FIRST \clients\client1\~dmtmp\*
Close 12557
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12558
ReadX 12558 0 2048 2048
WriteX 12558 18431 1 1
QUERY_FILE_INFORMATION 12558
WriteX 12558 0 19584 19584
Close 12558
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12559
ReadX 12559 0 4096 4096
ReadX 12559 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12559
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12560
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12560 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12561
ReadX 12561 0 4096 4096
ReadX 12560 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12562
ReadX 12562 0 4096 4096
ReadX 12562 0 4096 4096
Close 12562
Close 12561
Close 12560
Close 12530
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12563
QUERY_FILE_INFORMATION 12563
Close 12563
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12536
Close 12523
Close 12515
Close 12533
Close 12534
Close 12535
Close 12522
Close 12517
Close 12520
Close 12521
Close 12518
Close 12519
Close 12512
Close 12513
Close 12514
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12543
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12564
QUERY_FILE_INFORMATION 12564
Close 12564
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12553
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12565
QUERY_FILE_INFORMATION 12565
Close 12565
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12566
FIND_FIRST \clients\client1\~dmtmp\*
Close 12566
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12567
ReadX 12567 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12568
ReadX 12568 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12569
ReadX 12569 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12570
ReadX 12570 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12571
ReadX 12571 0 543 543
ReadX 12567 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12567 4096 16384 16384
WriteX 12567 0 4096 4096
Close 12567
WriteX 12568 0 4096 4096
WriteX 12569 0 4096 4096
WriteX 12570 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12572
FIND_FIRST \clients\client1\~dmtmp\*
Close 12572
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12573
ReadX 12573 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12574
ReadX 12574 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12575
ReadX 12575 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12576
ReadX 12576 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12577
ReadX 12577 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12578
ReadX 12578 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12579
ReadX 12579 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12580
ReadX 12580 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12581
ReadX 12581 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12582
ReadX 12582 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12583
ReadX 12583 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12584
ReadX 12584 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12585
ReadX 12585 0 4096 4096
ReadX 12573 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12586
ReadX 12586 0 8192 8192
ReadX 12573 4096 16384 16384
Close 12580
Close 12573
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12587
FIND_FIRST \clients\client1\~dmtmp\*
Close 12587
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12588
ReadX 12588 0 4096 4096
ReadX 12588 4096 4096 4096
ReadX 12588 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12589
ReadX 12589 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12590
ReadX 12590 0 4096 4096
ReadX 12589 0 4096 4096
ReadX 12589 0 4096 4096
ReadX 12589 4096 16384 16384
Close 12590
WriteX 12589 0 4096 4096
Close 12589
WriteX 12574 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12591
FIND_FIRST \clients\client1\~dmtmp\*
Close 12591
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12592
ReadX 12592 0 4096 4096
ReadX 12592 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12593
ReadX 12593 0 4096 4096
ReadX 12593 0 4096 4096
WriteX 12593 0 4096 4096
Close 12593
WriteX 12568 0 4096 4096
WriteX 12569 0 4096 4096
WriteX 12570 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12594
ReadX 12594 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12595
ReadX 12595 0 4096 4096
ReadX 12594 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12599
FIND_FIRST \clients\client1\~dmtmp\*
Close 12599
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12600
QUERY_FILE_INFORMATION 12600
WriteX 12600 2047 1 1
QUERY_FILE_INFORMATION 12600
WriteX 12600 0 2048 2048
Close 12600
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12601
ReadX 12601 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12601 4095 1 1
QUERY_FILE_INFORMATION 12601
ReadX 12601 0 4096 4096
WriteX 12601 0 4096 4096
Close 12601
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12602
ReadX 12602 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12602 0 4096 4096
Close 12595
Close 12594
WriteX 12602 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12603
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12603 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12604
ReadX 12604 0 4096 4096
ReadX 12603 0 4096 4096
ReadX 12603 4096 16384 16384
Close 12604
Close 12603
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12605
FIND_FIRST \clients\client1\~dmtmp\*
Close 12605
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12606
ReadX 12606 0 4096 4096
ReadX 12606 4096 4096 4096
WriteX 12606 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12606 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12606
ReadX 12602 0 4096 4096
WriteX 12602 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12607
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12607 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12608
ReadX 12608 0 4096 4096
ReadX 12607 0 4096 4096
ReadX 12607 4096 16384 16384
Close 12608
Close 12607
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12609
FIND_FIRST \clients\client1\~dmtmp\*
Close 12609
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12610
ReadX 12610 0 4096 4096
ReadX 12610 4096 4096 4096
WriteX 12610 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12610 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12610
Close 12602
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12611
QUERY_FILE_INFORMATION 12611
Close 12611
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 12586
Close 12588
Close 12592
Close 12571
Close 12568
Close 12569
Close 12570
Close 12579
Close 12584
Close 12581
Close 12582
Close 12583
Close 12585
Close 12574
Close 12577
Close 12578
Close 12575
Close 12576
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12612
FIND_FIRST \clients\client1\~dmtmp\*
Close 12612
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12613
ReadX 12613 0 4096 4096
ReadX 12613 4096 4096 4096
ReadX 12613 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12614
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12614 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12615
ReadX 12615 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12616
ReadX 12616 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12617
ReadX 12617 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12618
ReadX 12618 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12619
ReadX 12619 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12620
ReadX 12620 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12621
ReadX 12621 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12622
ReadX 12622 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12623
ReadX 12623 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12624
ReadX 12624 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12625
ReadX 12625 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12626
ReadX 12626 0 4096 4096
ReadX 12614 0 4096 4096
ReadX 12614 0 4096 4096
ReadX 12614 4096 16384 16384
Close 12621
Close 12614
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12627
ReadX 12627 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12628
ReadX 12628 0 4096 4096
ReadX 12627 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12632
FIND_FIRST \clients\client1\~dmtmp\*
Close 12632
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12633
QUERY_FILE_INFORMATION 12633
WriteX 12633 2047 1 1
QUERY_FILE_INFORMATION 12633
WriteX 12633 0 2048 2048
Close 12633
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12634
ReadX 12634 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12634 4095 1 1
QUERY_FILE_INFORMATION 12634
ReadX 12634 0 4096 4096
WriteX 12634 0 4096 4096
Close 12634
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12635
ReadX 12635 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12635 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12639
Close 12639
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12640
QUERY_FILE_INFORMATION 12640
WriteX 12640 2047 1 1
QUERY_FILE_INFORMATION 12640
WriteX 12640 0 2048 2048
Close 12640
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12641
ReadX 12641 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12641 4095 1 1
QUERY_FILE_INFORMATION 12641
ReadX 12641 0 4096 4096
WriteX 12641 0 4096 4096
Close 12641
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12642
ReadX 12642 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12642 0 4096 4096
Close 12627
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12643
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12643 0 4096 4096
ReadX 12643 0 4096 4096
ReadX 12643 4096 16384 16384
Close 12643
Close 12635
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12644
QUERY_FILE_INFORMATION 12644
Close 12644
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12613
Close 12625
Close 12620
Close 12626
Close 12628
Close 12615
Close 12618
Close 12619
Close 12616
Close 12617
Close 12622
Close 12623
Close 12624
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12642
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12645
QUERY_FILE_INFORMATION 12645
Close 12645
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12646
ReadX 12646 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 12647
Close 12647
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 12648
WriteX 12648 63 1 1
QUERY_FILE_INFORMATION 12648
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12646 0 4096 4096
ReadX 12646 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12646 0 8192 8192
Flush 12646
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12646 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12646 0 8192 8192
Flush 12646
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12646 0 8192 8192
Flush 12646
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12646 0 8192 8192
Flush 12646
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12650
Close 12650
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12652
WriteX 12652 4065 1 1
QUERY_FILE_INFORMATION 12652
WriteX 12652 0 62591 62591
Close 12652
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12654
Close 12654
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12656
WriteX 12656 4094 1 1
QUERY_FILE_INFORMATION 12656
WriteX 12656 0 10845 10845
Close 12656
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12658
Close 12658
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12660
WriteX 12660 4081 1 1
QUERY_FILE_INFORMATION 12660
WriteX 12660 0 30118 30118
Close 12660
WriteX 12646 0 4096 4096
Close 12646
WriteX 12648 0 64 64
Close 12648
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12661
ReadX 12661 61440 4096 4096
ReadX 12661 126976 4096 4096
WriteX 12661 0 65471 65471
WriteX 12661 65471 65 65
WriteX 12661 65536 65471 65471
WriteX 12661 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12662
ReadX 12662 61440 4096 4096
ReadX 12662 126976 4096 4096
ReadX 12662 192512 4096 4096
ReadX 12662 258048 4096 4096
WriteX 12662 0 65471 65471
WriteX 12662 65471 65 65
WriteX 12662 65536 65471 65471
WriteX 12662 131007 65 65
WriteX 12662 131072 65471 65471
WriteX 12662 196543 65 65
WriteX 12662 196608 65471 65471
WriteX 12662 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12663
ReadX 12663 61440 4096 4096
ReadX 12663 126976 4096 4096
ReadX 12663 192512 4096 4096
ReadX 12663 258048 4096 4096
ReadX 12663 323584 4096 4096
ReadX 12663 389120 4096 4096
ReadX 12663 454656 4096 4096
ReadX 12663 520192 4096 4096
WriteX 12663 0 65471 65471
WriteX 12663 65471 65 65
WriteX 12663 65536 65471 65471
WriteX 12663 131007 65 65
WriteX 12663 131072 65471 65471
WriteX 12663 196543 65 65
WriteX 12663 196608 65471 65471
WriteX 12663 262079 65 65
WriteX 12663 262144 65471 65471
WriteX 12663 327615 65 65
WriteX 12663 327680 65471 65471
WriteX 12663 393151 65 65
WriteX 12663 393216 65471 65471
WriteX 12663 458687 65 65
WriteX 12663 458752 65471 65471
WriteX 12663 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12664
Close 12664
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12661
Close 12662
Close 12663
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12665
ReadX 12665 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12666
ReadX 12666 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 12667
ReadX 12667 0 4096 4096
ReadX 12667 4096 4096 4096
ReadX 12667 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12668
Close 12668
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12665
Close 12666
Close 12667
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12669
Close 12669
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12670
ReadX 12670 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12671
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 12671
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12672
Close 12672
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12673
ReadX 12673 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12674
Close 12674
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12670
Close 12673
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12675
Close 12675
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12676
ReadX 12676 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12677
ReadX 12677 0 8192 8192
ReadX 12677 8192 8192 8192
ReadX 12677 16384 8192 8192
ReadX 12677 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12679
Close 12679
Close 12676
Close 12677
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12681
WriteX 12681 8191 1 1
QUERY_FILE_INFORMATION 12681
WriteX 12681 0 10438 10438
Close 12681
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12682
Close 12682
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12683
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12684
Close 12684
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12685
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12686
Close 12686
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12687
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12688
FIND_FIRST \clients\client1\~dmtmp\*
Close 12688
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12689
Close 12689
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12690
ReadX 12690 0 4096 4096
Close 12690
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12691
ReadX 12691 0 8192 8192
Close 12691
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12692
ReadX 12692 0 8192 8192
ReadX 12692 8192 4096 4096
ReadX 12692 12288 8192 8192
ReadX 12692 20480 8192 8192
ReadX 12692 28672 8192 8192
ReadX 12692 36864 8192 8192
ReadX 12692 45056 8192 8192
ReadX 12692 53248 8192 8192
ReadX 12692 61440 8192 8192
ReadX 12692 69632 8192 8192
ReadX 12692 77824 8192 8192
ReadX 12692 86016 8192 8192
ReadX 12692 94208 8192 8192
ReadX 12692 102400 8192 8192
ReadX 12692 110592 8192 8192
ReadX 12692 118784 8192 8192
ReadX 12692 126976 8192 8192
ReadX 12692 135168 8192 8192
ReadX 12692 143360 8192 8192
ReadX 12692 151552 8192 8192
ReadX 12692 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 12693
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12693
Close 12692
Close 12683
Close 12685
Close 12687
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 12694
Close 12694
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12696
WriteX 12696 8191 1 1
QUERY_FILE_INFORMATION 12696
WriteX 12696 0 28489 28489
Close 12696
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12697
Close 12697
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12698
FIND_FIRST \clients\client1\~dmtmp\*
Close 12698
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12699
Close 12699
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12700
ReadX 12700 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12701
Close 12701
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12700
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12702
Close 12702
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12703
ReadX 12703 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12704
ReadX 12704 0 8192 8192
ReadX 12704 8192 8192 8192
ReadX 12704 16384 8192 8192
ReadX 12704 24576 8192 8192
ReadX 12704 32768 16384 16384
ReadX 12704 49152 8192 8192
ReadX 12704 57344 8192 8192
ReadX 12704 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12706
Close 12706
Close 12703
Close 12704
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12708
WriteX 12708 8191 1 1
QUERY_FILE_INFORMATION 12708
WriteX 12708 0 29253 29253
Close 12708
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12709
Close 12709
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12710
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 12711
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12711
Close 12710
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 12712
Close 12712
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12714
WriteX 12714 8191 1 1
QUERY_FILE_INFORMATION 12714
WriteX 12714 0 30183 30183
Close 12714
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12715
Close 12715
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12716
WriteX 12716 0 510 510
WriteX 12716 510 512 512
WriteX 12716 1022 510 510
WriteX 12716 1532 510 510
WriteX 12716 2042 168 168
Close 12716
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12717
Close 12717
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12718
ReadX 12718 0 4096 4096
WriteX 12718 0 4096 4096
Close 12718
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12719
ReadX 12719 0 65471 65471
ReadX 12719 65471 65 65
ReadX 12719 65536 65471 65471
ReadX 12719 131007 65 65
ReadX 12719 131072 65471 65471
ReadX 12719 196543 65 65
ReadX 12719 196608 65471 65471
ReadX 12719 262079 65 65
ReadX 12719 262144 65471 65471
ReadX 12719 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12720
ReadX 12720 0 65471 65471
ReadX 12720 65471 65 65
ReadX 12720 65536 65471 65471
ReadX 12720 131007 65 65
ReadX 12720 131072 65471 65471
ReadX 12720 196543 65 65
ReadX 12720 196608 65471 65471
ReadX 12720 262079 65 65
ReadX 12720 262144 65471 65471
ReadX 12720 327615 65 65
ReadX 12720 327680 65471 65471
ReadX 12720 393151 65 65
ReadX 12720 393216 65471 65471
ReadX 12720 458687 65 65
ReadX 12720 458752 65471 65471
ReadX 12720 524223 65 65
ReadX 12720 524288 65471 65471
ReadX 12720 589759 65 65
ReadX 12720 589824 65471 65471
ReadX 12720 655295 65 65
ReadX 12720 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12721
ReadX 12721 0 65471 65471
ReadX 12721 65471 65 65
ReadX 12721 65536 65471 65471
ReadX 12721 131007 65 65
ReadX 12721 131072 65471 65471
ReadX 12721 196543 65 65
ReadX 12721 196608 65471 65471
ReadX 12721 262079 65 65
ReadX 12721 262144 65471 65471
ReadX 12721 327615 65 65
ReadX 12721 327680 65471 65471
ReadX 12721 393151 65 65
ReadX 12721 393216 65471 65471
ReadX 12721 458687 65 65
ReadX 12721 458752 65471 65471
ReadX 12721 524223 65 65
ReadX 12721 524288 65471 65471
ReadX 12721 589759 65 65
ReadX 12721 589824 65471 65471
ReadX 12721 655295 65 65
ReadX 12721 655360 65471 65471
ReadX 12721 720831 65 65
ReadX 12721 720896 65471 65471
ReadX 12721 786367 65 65
ReadX 12721 786432 65471 65471
ReadX 12721 851903 65 65
ReadX 12721 851968 65471 65471
ReadX 12721 917439 65 65
ReadX 12721 917504 65471 65471
ReadX 12721 982975 65 65
ReadX 12721 983040 65471 65471
ReadX 12721 1048511 65 65
ReadX 12721 1048576 65471 65471
ReadX 12721 1114047 65 65
ReadX 12721 1114112 65471 65471
ReadX 12721 1179583 65 65
ReadX 12721 1179648 65471 65471
ReadX 12721 1245119 65 65
ReadX 12721 1245184 65471 65471
ReadX 12721 1310655 65 65
ReadX 12721 1310720 65471 65471
ReadX 12721 1376191 65 65
ReadX 12721 1376256 65471 65471
ReadX 12721 1441727 65 65
ReadX 12721 1441792 65471 65471
ReadX 12721 1507263 65 65
ReadX 12721 1507328 65471 65471
ReadX 12721 1572799 65 65
ReadX 12721 1572864 65471 65471
ReadX 12721 1638335 65 65
ReadX 12721 1638400 65471 65471
ReadX 12721 1703871 65 65
ReadX 12721 1703936 65471 65471
ReadX 12721 1769407 65 65
ReadX 12721 1769472 65471 65471
ReadX 12721 1834943 65 65
ReadX 12721 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12722
ReadX 12722 0 4096 4096
ReadX 12722 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 12723
WriteX 12723 52 1 1
QUERY_FILE_INFORMATION 12723
WriteX 12723 0 53 53
Close 12723
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12724
Close 12724
Close 12719
Close 12720
Close 12721
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12722 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12725
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12722 0 4096 4096
ReadX 12722 4096 4096 4096
ReadX 12722 8192 4096 4096
ReadX 12722 12288 4096 4096
WriteX 12725 15359 1 1
QUERY_FILE_INFORMATION 12725
ReadX 12722 16384 4096 4096
ReadX 12722 20480 4096 4096
WriteX 12725 0 15360 15360
Close 12725
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 12726
ReadX 12726 0 4096 4096
WriteX 12726 0 4096 4096
Close 12726
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 12727
Close 12727
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12728
ReadX 12728 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 12729
Close 12729
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 12722
ReadX 12728 0 4096 4096
ReadX 12728 4096 4096 4096
ReadX 12728 8192 4096 4096
ReadX 12728 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12730
ReadX 12730 0 4096 4096
ReadX 12730 0 4096 4096
ReadX 12730 4096 4096 4096
ReadX 12730 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12731
ReadX 12731 0 4096 4096
ReadX 12731 4096 4096 4096
ReadX 12731 8192 4096 4096
Close 12730
Close 12731
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12732
WriteX 12732 15359 1 1
QUERY_FILE_INFORMATION 12732
WriteX 12732 0 15360 15360
Close 12732
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 12733
ReadX 12733 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 12728
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12734
Close 12734
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12735
ReadX 12735 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 12736
Close 12736
WriteX 12733 0 4096 4096
Close 12733
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 12737
Close 12737
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12738
ReadX 12738 0 4096 4096
ReadX 12738 0 4096 4096
ReadX 12738 4096 4096 4096
ReadX 12738 8192 4096 4096
ReadX 12738 12288 3072 3072
ReadX 12738 0 8192 8192
ReadX 12738 8192 4096 4096
ReadX 12738 12288 3072 3072
WriteX 12738 15469 1 1
QUERY_FILE_INFORMATION 12738
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12739
ReadX 12739 0 4096 4096
ReadX 12739 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 12740
WriteX 12740 52 1 1
QUERY_FILE_INFORMATION 12740
WriteX 12740 0 53 53
Close 12740
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12741
Close 12741
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12742
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12739 0 8192 8192
ReadX 12739 8192 4096 4096
ReadX 12739 12288 4096 4096
WriteX 12742 12005 1 1
QUERY_FILE_INFORMATION 12742
WriteX 12742 0 12006 12006
Close 12742
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 12743
ReadX 12743 0 4096 4096
WriteX 12743 0 4096 4096
Close 12743
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 12744
Close 12744
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12745
ReadX 12745 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 12746
Close 12746
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 12739
ReadX 12745 0 4096 4096
ReadX 12745 4096 4096 4096
ReadX 12745 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12747
WriteX 12747 11990 1 1
QUERY_FILE_INFORMATION 12747
WriteX 12747 0 11991 11991
Close 12747
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 12748
ReadX 12748 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 12745
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12749
Close 12749
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12750
ReadX 12750 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 12751
Close 12751
WriteX 12748 0 4096 4096
Close 12748
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 12752
Close 12752
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12753
ReadX 12753 0 4096 4096
ReadX 12753 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12754
Close 12754
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 12753 0 8192 8192
ReadX 12753 8192 3799 3799
WriteX 12753 13247 1 1
QUERY_FILE_INFORMATION 12753
WriteX 12753 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12753 0 8192 8192
ReadX 12753 8192 4096 4096
Close 12735
WriteX 12738 0 19054 19054
Close 12738
WriteX 12753 0 12288 12288
Close 12753
Close 12750
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12755
Close 12755
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12756
Close 12756
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12757
ReadX 12757 61440 4096 4096
ReadX 12757 126976 4096 4096
WriteX 12757 0 65471 65471
WriteX 12757 65471 65 65
WriteX 12757 65536 65471 65471
WriteX 12757 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12758
ReadX 12758 61440 4096 4096
ReadX 12758 126976 4096 4096
ReadX 12758 192512 4096 4096
ReadX 12758 258048 4096 4096
WriteX 12758 0 65471 65471
WriteX 12758 65471 65 65
WriteX 12758 65536 65471 65471
WriteX 12758 131007 65 65
WriteX 12758 131072 65471 65471
WriteX 12758 196543 65 65
WriteX 12758 196608 65471 65471
WriteX 12758 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12759
ReadX 12759 61440 4096 4096
ReadX 12759 126976 4096 4096
ReadX 12759 192512 4096 4096
ReadX 12759 258048 4096 4096
ReadX 12759 323584 4096 4096
ReadX 12759 389120 4096 4096
ReadX 12759 454656 4096 4096
ReadX 12759 520192 4096 4096
WriteX 12759 0 65471 65471
WriteX 12759 65471 65 65
WriteX 12759 65536 65471 65471
WriteX 12759 131007 65 65
WriteX 12759 131072 65471 65471
WriteX 12759 196543 65 65
WriteX 12759 196608 65471 65471
WriteX 12759 262079 65 65
WriteX 12759 262144 65471 65471
WriteX 12759 327615 65 65
WriteX 12759 327680 65471 65471
WriteX 12759 393151 65 65
WriteX 12759 393216 65471 65471
WriteX 12759 458687 65 65
WriteX 12759 458752 65471 65471
WriteX 12759 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12760
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12760 0 4096 4096
Close 12760
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12761
ReadX 12761 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12761
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12762
ReadX 12762 0 4096 4096
ReadX 12762 4096 4096 4096
ReadX 12762 8192 4096 4096
ReadX 12762 12288 4096 4096
ReadX 12762 16384 4096 4096
ReadX 12762 20480 4096 4096
ReadX 12762 24576 4096 4096
ReadX 12762 28672 4096 4096
ReadX 12762 32768 4096 4096
ReadX 12762 36864 4096 4096
ReadX 12762 40960 4096 4096
ReadX 12762 45056 4096 4096
ReadX 12762 49152 4096 4096
ReadX 12762 53248 4096 4096
ReadX 12762 57344 4096 4096
ReadX 12762 61440 4096 4096
ReadX 12762 65536 4096 4096
ReadX 12762 69632 4096 4096
ReadX 12762 73728 4096 4096
WriteX 12762 0 4096 4096
Close 12762
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12763
Close 12763
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12764
ReadX 12764 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12765
Close 12765
Close 12757
Close 12758
Close 12759
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12764
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12767
WriteX 12767 4607 1 1
QUERY_FILE_INFORMATION 12767
WriteX 12767 0 65471 65471
WriteX 12767 65471 65 65
WriteX 12767 65536 19979 19979
Close 12767
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12768
ReadX 12768 0 4096 4096
WriteX 12768 0 4096 4096
Flush 12768
WriteX 12768 0 4096 4096
Flush 12768
QUERY_FILE_INFORMATION 12768
WriteX 12768 0 4096 4096
Flush 12768
WriteX 12768 0 4096 4096
Flush 12768
WriteX 12768 0 4096 4096
Flush 12768
WriteX 12768 0 4096 4096
Flush 12768
Close 12768
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12769
ReadX 12769 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 12770
ReadX 12770 0 4096 4096
Close 12769
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12771
ReadX 12771 0 4096 4096
Close 12771
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12772
ReadX 12772 0 4096 4096
Close 12772
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12773
ReadX 12773 0 4096 4096
WriteX 12773 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 12774
Close 12774
Close 12770
Close 12773
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12775
Close 12775
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12777
WriteX 12777 4607 1 1
QUERY_FILE_INFORMATION 12777
WriteX 12777 0 65471 65471
WriteX 12777 65471 65 65
WriteX 12777 65536 17654 17654
Close 12777
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12778
ReadX 12778 0 4096 4096
WriteX 12778 0 4096 4096
Flush 12778
WriteX 12778 0 4096 4096
Flush 12778
QUERY_FILE_INFORMATION 12778
WriteX 12778 0 4096 4096
Flush 12778
WriteX 12778 0 4096 4096
Flush 12778
WriteX 12778 0 4096 4096
Flush 12778
WriteX 12778 0 4096 4096
Flush 12778
Close 12778
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12779
Close 12779
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12780
ReadX 12780 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 12781
Close 12781
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 12782
ReadX 12782 0 4096 4096
ReadX 12782 4096 4096 4096
ReadX 12782 8192 4096 4096
ReadX 12782 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12782 16384 4096 4096
ReadX 12782 20480 4096 4096
ReadX 12782 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 12780
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12783
ReadX 12783 0 4096 4096
Close 12783
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12784
ReadX 12784 0 4096 4096
Close 12784
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12785
ReadX 12785 0 4096 4096
WriteX 12785 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 12786
Close 12786
Close 12785
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12787
Close 12787
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12789
WriteX 12789 4607 1 1
QUERY_FILE_INFORMATION 12789
WriteX 12789 0 65471 65471
WriteX 12789 65471 65 65
WriteX 12789 65536 19490 19490
Close 12789
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12790
ReadX 12790 0 4096 4096
WriteX 12790 0 4096 4096
Flush 12790
WriteX 12790 0 4096 4096
Flush 12790
QUERY_FILE_INFORMATION 12790
WriteX 12790 0 4096 4096
Flush 12790
WriteX 12790 0 4096 4096
Flush 12790
WriteX 12790 0 4096 4096
Flush 12790
WriteX 12790 0 4096 4096
Flush 12790
Close 12790
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12791
Close 12791
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12792
ReadX 12792 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 12793
Close 12793
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12792
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12794
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12794 0 4096 4096
Close 12794
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12795
ReadX 12795 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12795
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12796
ReadX 12796 0 4096 4096
ReadX 12796 4096 4096 4096
ReadX 12796 8192 4096 4096
ReadX 12796 12288 4096 4096
ReadX 12796 16384 4096 4096
ReadX 12796 20480 4096 4096
ReadX 12796 24576 4096 4096
ReadX 12796 28672 4096 4096
ReadX 12796 32768 4096 4096
ReadX 12796 36864 4096 4096
ReadX 12796 40960 4096 4096
ReadX 12796 45056 4096 4096
ReadX 12796 49152 4096 4096
ReadX 12796 53248 4096 4096
ReadX 12796 57344 4096 4096
ReadX 12796 61440 4096 4096
ReadX 12796 65536 4096 4096
ReadX 12796 69632 4096 4096
ReadX 12796 73728 4096 4096
WriteX 12796 0 4096 4096
Close 12796
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12797
Close 12797
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12798
ReadX 12798 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12799
Close 12799
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12798
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12801
WriteX 12801 4607 1 1
QUERY_FILE_INFORMATION 12801
WriteX 12801 0 65471 65471
WriteX 12801 65471 65 65
WriteX 12801 65536 8866 8866
Close 12801
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12802
ReadX 12802 0 4096 4096
WriteX 12802 0 4096 4096
Flush 12802
WriteX 12802 0 4096 4096
Flush 12802
Close 12802
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12803
ReadX 12803 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12803
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12804
ReadX 12804 0 4096 4096
Close 12804
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12805
ReadX 12805 0 4096 4096
Close 12805
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12806
ReadX 12806 0 4096 4096
WriteX 12806 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 12807
Close 12807
Close 12806
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12808
Close 12808
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12810
WriteX 12810 4607 1 1
QUERY_FILE_INFORMATION 12810
WriteX 12810 0 65471 65471
WriteX 12810 65471 65 65
WriteX 12810 65536 9298 9298
Close 12810
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12811
ReadX 12811 0 4096 4096
WriteX 12811 0 4096 4096
Flush 12811
WriteX 12811 0 4096 4096
Flush 12811
Close 12811
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12812
Close 12812
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12813
ReadX 12813 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 12814
Close 12814
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12816
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12816 0 4096 4096
Close 12816
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12817
ReadX 12817 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12817 4096 4096 4096
ReadX 12817 8192 4096 4096
ReadX 12817 12288 4096 4096
ReadX 12817 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 12813
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12818
ReadX 12818 0 4096 4096
Close 12818
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12819
ReadX 12819 0 4096 4096
Close 12819
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12820
ReadX 12820 0 4096 4096
WriteX 12820 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 12821
Close 12821
Close 12817
Close 12820
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12822
Close 12822
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12824
WriteX 12824 4607 1 1
QUERY_FILE_INFORMATION 12824
WriteX 12824 0 65471 65471
WriteX 12824 65471 65 65
WriteX 12824 65536 11540 11540
Close 12824
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12825
ReadX 12825 0 4096 4096
WriteX 12825 0 4096 4096
Flush 12825
WriteX 12825 0 4096 4096
Flush 12825
Close 12825
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12826
Close 12826
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12827
ReadX 12827 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 12828
Close 12828
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12827
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12829
ReadX 12829 0 65471 65471
ReadX 12829 65471 65 65
ReadX 12829 65536 65471 65471
ReadX 12829 131007 65 65
ReadX 12829 131072 65471 65471
ReadX 12829 196543 65 65
ReadX 12829 196608 65471 65471
ReadX 12829 262079 65 65
ReadX 12829 262144 65471 65471
ReadX 12829 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12830
ReadX 12830 0 65471 65471
ReadX 12830 65471 65 65
ReadX 12830 65536 65471 65471
ReadX 12830 131007 65 65
ReadX 12830 131072 65471 65471
ReadX 12830 196543 65 65
ReadX 12830 196608 65471 65471
ReadX 12830 262079 65 65
ReadX 12830 262144 65471 65471
ReadX 12830 327615 65 65
ReadX 12830 327680 65471 65471
ReadX 12830 393151 65 65
ReadX 12830 393216 65471 65471
ReadX 12830 458687 65 65
ReadX 12830 458752 65471 65471
ReadX 12830 524223 65 65
ReadX 12830 524288 65471 65471
ReadX 12830 589759 65 65
ReadX 12830 589824 65471 65471
ReadX 12830 655295 65 65
ReadX 12830 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12831
ReadX 12831 0 65471 65471
ReadX 12831 65471 65 65
ReadX 12831 65536 65471 65471
ReadX 12831 131007 65 65
ReadX 12831 131072 65471 65471
ReadX 12831 196543 65 65
ReadX 12831 196608 65471 65471
ReadX 12831 262079 65 65
ReadX 12831 262144 65471 65471
ReadX 12831 327615 65 65
ReadX 12831 327680 65471 65471
Close 12782
ReadX 12831 393151 65 65
ReadX 12831 393216 65471 65471
Close 12829
ReadX 12831 458687 65 65
ReadX 12831 458752 65471 65471
Close 12830
ReadX 12831 524223 65 65
ReadX 12831 524288 65471 65471
ReadX 12831 589759 65 65
ReadX 12831 589824 65471 65471
ReadX 12831 655295 65 65
ReadX 12831 655360 65471 65471
ReadX 12831 720831 65 65
ReadX 12831 720896 65471 65471
ReadX 12831 786367 65 65
ReadX 12831 786432 65471 65471
ReadX 12831 851903 65 65
ReadX 12831 851968 65471 65471
ReadX 12831 917439 65 65
ReadX 12831 917504 65471 65471
ReadX 12831 982975 65 65
ReadX 12831 983040 65471 65471
ReadX 12831 1048511 65 65
ReadX 12831 1048576 65471 65471
ReadX 12831 1114047 65 65
ReadX 12831 1114112 65471 65471
ReadX 12831 1179583 65 65
ReadX 12831 1179648 65471 65471
ReadX 12831 1245119 65 65
ReadX 12831 1245184 65471 65471
ReadX 12831 1310655 65 65
ReadX 12831 1310720 65471 65471
ReadX 12831 1376191 65 65
ReadX 12831 1376256 65471 65471
ReadX 12831 1441727 65 65
ReadX 12831 1441792 65471 65471
ReadX 12831 1507263 65 65
ReadX 12831 1507328 65471 65471
ReadX 12831 1572799 65 65
ReadX 12831 1572864 65471 65471
ReadX 12831 1638335 65 65
ReadX 12831 1638400 65471 65471
ReadX 12831 1703871 65 65
ReadX 12831 1703936 65471 65471
ReadX 12831 1769407 65 65
ReadX 12831 1769472 65471 65471
ReadX 12831 1834943 65 65
ReadX 12831 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12832
FIND_FIRST \clients\client1\~dmtmp\*
Close 12832
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12833
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12834
QUERY_FILE_INFORMATION 12834
QUERY_FILE_INFORMATION 12834
QUERY_FILE_INFORMATION 12834
ReadX 12834 2156 24 24
ReadX 12834 2139 276 276
ReadX 12834 2136 14 14
ReadX 12834 2136 7 7
ReadX 12834 2138 12 12
ReadX 12834 2137 8 8
ReadX 12834 2135 15 15
ReadX 12834 0 16 16
ReadX 12834 16 2048 2048
ReadX 12834 2064 2048 2048
ReadX 12834 257 2048 2048
ReadX 12834 385 2048 2048
ReadX 12834 513 2048 2048
ReadX 12834 641 2048 2048
ReadX 12834 769 2048 2048
ReadX 12834 897 2048 2048
ReadX 12834 1025 2048 2048
ReadX 12834 1153 2048 2048
ReadX 12834 1281 2048 2048
ReadX 12834 1409 2048 2048
ReadX 12834 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12836
Close 12836
Close 12831
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12838
WriteX 12838 15 1 1
QUERY_FILE_INFORMATION 12838
WriteX 12838 0 10575 10575
Flush 12838
Close 12838
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12839
Close 12839
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12840
ReadX 12840 0 4096 4096
Close 12834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12841
Close 12841
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12842
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12843
QUERY_FILE_INFORMATION 12843
ReadX 12843 0 512 512
ReadX 12843 512 512 512
ReadX 12843 1024 512 512
QUERY_FILE_INFORMATION 12843
QUERY_FILE_INFORMATION 12843
Close 12843
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12844
QUERY_FILE_INFORMATION 12844
ReadX 12844 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12845
QUERY_FILE_INFORMATION 12845
ReadX 12845 0 512 512
ReadX 12845 512 512 512
ReadX 12845 1024 512 512
ReadX 12845 288 20 20
ReadX 12845 308 2084 2084
ReadX 12845 388 2084 2084
ReadX 12845 388 2084 2084
ReadX 12833 2157 1386 1386
ReadX 12845 2472 399 399
ReadX 12845 3072 1536 1536
ReadX 12845 544 149 149
ReadX 12845 693 485 485
Close 12845
ReadX 12833 2157 4096 4096
ReadX 12833 6253 4096 4096
ReadX 12833 10349 4096 4096
ReadX 12833 14445 4096 4096
ReadX 12833 18541 4096 4096
ReadX 12833 22637 256 256
ReadX 12833 22893 4096 4096
ReadX 12833 26989 4096 4096
ReadX 12833 31085 4096 4096
ReadX 12833 35181 4096 4096
ReadX 12833 39277 4096 4096
ReadX 12833 43373 4096 4096
ReadX 12833 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12833 2157 1024 1024
ReadX 12833 1667 4688 4688
ReadX 12833 6355 3516 3516
ReadX 12833 9871 16384 16384
ReadX 12833 26255 3771 3771
ReadX 12833 30026 2048 2048
ReadX 12833 32074 1024 1024
ReadX 12833 33098 6652 6652
ReadX 12833 39750 16384 16384
ReadX 12833 56134 10496 10496
ReadX 12833 66630 1784 1784
ReadX 12833 68414 90 90
ReadX 12833 68504 273 273
ReadX 12833 68777 1600 1600
ReadX 12833 70377 640 640
ReadX 12833 71017 1280 1280
ReadX 12833 72297 8464 8464
ReadX 12833 80761 158 158
ReadX 12833 80919 912 912
ReadX 12833 81831 1980 1980
ReadX 12833 83811 2256 2256
ReadX 12833 86067 400 400
ReadX 12833 86467 252 252
ReadX 12833 86719 42 42
ReadX 12833 86761 725 725
ReadX 12833 2009 512 512
ReadX 12833 3895 9 9
ReadX 12833 3781 46 46
ReadX 12833 4059 92 92
ReadX 12833 3781 92 92
ReadX 12833 3986 184 184
ReadX 12833 3987 16384 16384
ReadX 12833 3902 16384 16384
ReadX 12833 3781 10240 10240
ReadX 12833 3821 16384 16384
ReadX 12833 3891 935 935
ReadX 12833 4060 10240 10240
ReadX 12833 4059 184 184
ReadX 12833 256 184 184
ReadX 12833 256 1026 1026
ReadX 12833 3901 326 326
ReadX 12833 3899 652 652
ReadX 12833 256 2 2
ReadX 12833 258 4948 4948
Close 12833
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12847
Close 12847
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12849
WriteX 12849 4055 1 1
QUERY_FILE_INFORMATION 12849
WriteX 12849 0 65471 65471
WriteX 12849 65471 65 65
WriteX 12849 65536 65471 65471
WriteX 12849 131007 65 65
WriteX 12849 131072 65471 65471
WriteX 12849 196543 65 65
WriteX 12849 196608 65471 65471
WriteX 12849 262079 65 65
WriteX 12849 262144 65471 65471
WriteX 12849 327615 65 65
WriteX 12849 327680 65471 65471
WriteX 12849 393151 65 65
WriteX 12849 393216 65471 65471
WriteX 12849 458687 65 65
WriteX 12849 458752 65471 65471
WriteX 12849 524223 65 65
WriteX 12849 524288 65471 65471
WriteX 12849 589759 65 65
WriteX 12849 589824 35257 35257
Close 12849
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12851
Close 12851
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12853
WriteX 12853 4055 1 1
QUERY_FILE_INFORMATION 12853
WriteX 12853 0 65471 65471
WriteX 12853 65471 65 65
WriteX 12853 65536 65471 65471
WriteX 12853 131007 65 65
WriteX 12853 131072 65471 65471
WriteX 12853 196543 65 65
WriteX 12853 196608 65471 65471
WriteX 12853 262079 65 65
WriteX 12853 262144 65471 65471
WriteX 12853 327615 65 65
WriteX 12853 327680 65471 65471
WriteX 12853 393151 65 65
WriteX 12853 393216 65471 65471
WriteX 12853 458687 65 65
WriteX 12853 458752 65471 65471
WriteX 12853 524223 65 65
WriteX 12853 524288 65471 65471
WriteX 12853 589759 65 65
WriteX 12853 589824 57598 57598
Close 12853
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12855
WriteX 12855 15 1 1
QUERY_FILE_INFORMATION 12855
WriteX 12855 0 12543 12543
Flush 12855
Close 12855
Close 12840
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12856
Close 12856
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12857
ReadX 12857 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12858
FIND_FIRST \clients\client1\~dmtmp\*
Close 12858
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12859
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12860
QUERY_FILE_INFORMATION 12860
QUERY_FILE_INFORMATION 12860
QUERY_FILE_INFORMATION 12860
ReadX 12860 1938 24 24
ReadX 12860 1920 276 276
ReadX 12860 1918 14 14
ReadX 12860 1918 7 7
ReadX 12860 1919 12 12
ReadX 12860 1919 8 8
ReadX 12860 1917 15 15
ReadX 12860 0 16 16
ReadX 12860 16 2048 2048
ReadX 12860 2064 2048 2048
ReadX 12860 257 2048 2048
ReadX 12860 385 2048 2048
ReadX 12860 513 2048 2048
ReadX 12860 641 2048 2048
ReadX 12860 769 2048 2048
ReadX 12860 897 2048 2048
ReadX 12860 1025 2048 2048
ReadX 12860 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12862
Close 12862
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12864
WriteX 12864 15 1 1
QUERY_FILE_INFORMATION 12864
WriteX 12864 0 11588 11588
Flush 12864
Close 12864
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12865
Close 12865
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12866
ReadX 12866 0 4096 4096
Close 12860
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12868
WriteX 12868 15 1 1
QUERY_FILE_INFORMATION 12868
WriteX 12868 0 11615 11615
Flush 12868
Close 12868
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12866
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12869
Close 12869
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12870
ReadX 12870 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12872
Close 12872
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12874
WriteX 12874 4088 1 1
QUERY_FILE_INFORMATION 12874
WriteX 12874 0 65471 65471
WriteX 12874 65471 65 65
WriteX 12874 65536 16050 16050
Close 12874
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12859 1939 64 64
ReadX 12859 128 248 248
ReadX 12859 128 568 568
ReadX 12859 3872 1536 1536
ReadX 12859 3456 2560 2560
ReadX 12859 3136 512 512
ReadX 12859 2880 4096 4096
ReadX 12859 3264 3072 3072
ReadX 12859 320 4096 4096
ReadX 12859 1024 4096 4096
ReadX 12859 3616 4096 4096
ReadX 12859 1939 64 64
ReadX 12859 128 248 248
ReadX 12859 128 608 608
ReadX 12859 2858 1024 1024
ReadX 12859 2810 4096 4096
ReadX 12859 2826 4096 4096
ReadX 12859 2580 2048 2048
ReadX 12859 2800 2560 2560
ReadX 12859 2100 4096 4096
ReadX 12859 2084 4096 4096
ReadX 12859 868 4096 4096
ReadX 12859 2324 4096 4096
ReadX 12859 884 4096 4096
ReadX 12859 2604 1024 1024
ReadX 12859 580 4096 4096
ReadX 12859 596 4096 4096
ReadX 12859 2752 4096 4096
ReadX 12859 2842 1024 1024
ReadX 12859 660 4096 4096
ReadX 12859 2720 4096 4096
ReadX 12859 2736 4096 4096
ReadX 12859 628 4096 4096
ReadX 12859 2704 4096 4096
ReadX 12859 1556 4096 4096
ReadX 12859 576 4096 4096
ReadX 12859 3168 1536 1536
ReadX 12859 832 4096 4096
ReadX 12859 1088 4096 4096
ReadX 12859 1344 4096 4096
ReadX 12859 1600 4096 4096
ReadX 12859 1856 4096 4096
ReadX 12859 2112 4096 4096
ReadX 12859 1892 4096 4096
ReadX 12859 820 4096 4096
ReadX 12859 788 4096 4096
ReadX 12859 1604 4096 4096
ReadX 12859 3648 4096 4096
ReadX 12859 2608 4096 4096
ReadX 12859 548 4096 4096
ReadX 12859 740 4096 4096
ReadX 12859 1344 4096 4096
ReadX 12859 3392 4096 4096
ReadX 12859 3904 4096 4096
ReadX 12859 644 4096 4096
ReadX 12859 676 4096 4096
ReadX 12859 2688 4096 4096
ReadX 12859 320 4096 4096
ReadX 12859 900 4096 4096
ReadX 12859 1908 4096 4096
ReadX 12859 852 4096 4096
ReadX 12859 724 4096 4096
ReadX 12859 2292 4096 4096
ReadX 12859 612 4096 4096
ReadX 12859 388 4096 4096
ReadX 12859 2368 4096 4096
ReadX 12859 2624 4096 4096
ReadX 12859 500 4096 4096
ReadX 12859 356 4096 4096
ReadX 12859 1024 4096 4096
ReadX 12859 576 4096 4096
ReadX 12859 340 4096 4096
ReadX 12859 420 4096 4096
ReadX 12859 1600 4096 4096
ReadX 12859 404 4096 4096
ReadX 12859 1428 4096 4096
ReadX 12859 2656 4096 4096
ReadX 12859 2624 4096 4096
ReadX 12859 452 4096 4096
ReadX 12859 692 4096 4096
ReadX 12859 564 4096 4096
ReadX 12859 372 4096 4096
ReadX 12859 468 4096 4096
ReadX 12859 484 4096 4096
ReadX 12859 1088 4096 4096
ReadX 12859 1924 4096 4096
ReadX 12859 2768 4096 4096
ReadX 12859 832 4096 4096
ReadX 12859 836 4096 4096
ReadX 12859 1856 4096 4096
ReadX 12859 2640 4096 4096
ReadX 12859 436 4096 4096
ReadX 12859 1828 4096 4096
ReadX 12859 804 4096 4096
ReadX 12859 1860 4096 4096
ReadX 12859 1812 4096 4096
ReadX 12859 756 4096 4096
ReadX 12859 1636 4096 4096
ReadX 12859 772 4096 4096
ReadX 12859 2036 4096 4096
ReadX 12859 1220 4096 4096
ReadX 12859 1652 4096 4096
ReadX 12859 2588 4096 4096
ReadX 12859 916 4096 4096
ReadX 12859 260 4096 4096
ReadX 12859 932 4096 4096
ReadX 12859 2624 4096 4096
ReadX 12859 308 4096 4096
ReadX 12859 292 4096 4096
ReadX 12859 1140 4096 4096
ReadX 12859 276 4096 4096
ReadX 12859 2020 4096 4096
ReadX 12859 2880 4096 4096
ReadX 12859 516 4096 4096
ReadX 12859 1844 4096 4096
ReadX 12859 1124 4096 4096
ReadX 12859 3136 4096 4096
ReadX 12859 324 4096 4096
ReadX 12859 1156 4096 4096
ReadX 12859 1172 4096 4096
ReadX 12859 2112 4096 4096
ReadX 12859 2368 4096 4096
ReadX 12859 964 4096 4096
ReadX 12859 980 4096 4096
ReadX 12859 1012 4096 4096
ReadX 12859 532 4096 4096
ReadX 12859 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12859 1620 4096 4096
ReadX 12859 1604 4096 4096
ReadX 12859 2116 4096 4096
ReadX 12859 2132 4096 4096
ReadX 12859 2148 4096 4096
ReadX 12859 2276 4096 4096
ReadX 12859 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12876
Close 12876
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12878
QUERY_FILE_INFORMATION 12842
Close 12842
WriteX 12878 4088 1 1
QUERY_FILE_INFORMATION 12878
QUERY_FILE_INFORMATION 12844
Close 12844
WriteX 12878 0 65471 65471
WriteX 12878 65471 65 65
WriteX 12878 65536 64850 64850
Close 12878
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12880
WriteX 12880 15 1 1
QUERY_FILE_INFORMATION 12880
ReadX 12859 2068 4096 4096
ReadX 12859 1588 4096 4096
ReadX 12859 1572 4096 4096
WriteX 12880 0 18630 18630
Flush 12880
Close 12880
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12881
Close 12881
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12882
ReadX 12882 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 12859 612 4096 4096
ReadX 12859 564 4096 4096
ReadX 12859 1876 4096 4096
ReadX 12859 628 4096 4096
ReadX 12859 740 4096 4096
ReadX 12859 724 4096 4096
ReadX 12859 644 4096 4096
ReadX 12859 2324 4096 4096
ReadX 12859 660 4096 4096
ReadX 12859 852 4096 4096
ReadX 12859 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 12859 2368 4096 4096
ReadX 12859 1024 4096 4096
ReadX 12859 320 4096 4096
ReadX 12859 580 4096 4096
ReadX 12859 3136 512 512
ReadX 12859 2880 4096 4096
Close 12859
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12883
ReadX 12883 61440 4096 4096
ReadX 12883 126976 4096 4096
WriteX 12883 0 65471 65471
WriteX 12883 65471 65 65
WriteX 12883 65536 65471 65471
WriteX 12883 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12884
ReadX 12884 61440 4096 4096
ReadX 12884 126976 4096 4096
ReadX 12884 192512 4096 4096
ReadX 12884 258048 4096 4096
WriteX 12884 0 65471 65471
WriteX 12884 65471 65 65
WriteX 12884 65536 65471 65471
WriteX 12884 131007 65 65
WriteX 12884 131072 65471 65471
WriteX 12884 196543 65 65
WriteX 12884 196608 65471 65471
WriteX 12884 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12885
ReadX 12885 61440 4096 4096
ReadX 12885 126976 4096 4096
ReadX 12885 192512 4096 4096
ReadX 12885 258048 4096 4096
ReadX 12885 323584 4096 4096
ReadX 12885 389120 4096 4096
ReadX 12885 454656 4096 4096
ReadX 12885 520192 4096 4096
WriteX 12885 0 65471 65471
WriteX 12885 65471 65 65
WriteX 12885 65536 65471 65471
WriteX 12885 131007 65 65
WriteX 12885 131072 65471 65471
WriteX 12885 196543 65 65
WriteX 12885 196608 65471 65471
WriteX 12885 262079 65 65
WriteX 12885 262144 65471 65471
WriteX 12885 327615 65 65
WriteX 12885 327680 65471 65471
WriteX 12885 393151 65 65
WriteX 12885 393216 65471 65471
WriteX 12885 458687 65 65
WriteX 12885 458752 65471 65471
WriteX 12885 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12886
Close 12886
Close 12882
Close 12857
Close 12883
Close 12884
Close 12885
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12887
Close 12887
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 12890
Close 12890
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 12892
Close 12892
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 12893
Close 12893
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12896
Close 12896
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12898
Close 12898
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12899
Close 12899
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12902
Close 12902
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12906
Close 12906
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12910
Close 12910
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12914
Close 12914
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12918
Close 12918
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12922
Close 12922
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12926
Close 12926
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12930
Close 12930
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12932
Close 12932
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12934
Close 12934
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12936
WriteX 12936 4095 1 1
QUERY_FILE_INFORMATION 12936
QUERY_FS_INFORMATION 259
WriteX 12936 0 65471 65471
WriteX 12936 65471 65 65
WriteX 12936 65536 65471 65471
WriteX 12936 131007 65 65
WriteX 12936 131072 65471 65471
WriteX 12936 196543 65 65
WriteX 12936 196608 65471 65471
WriteX 12936 262079 65 65
WriteX 12936 262144 26634 26634
Close 12936
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12941
Close 12941
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12942
Close 12942
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12943
ReadX 12943 0 4096 4096
Close 12943
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12944
ReadX 12944 0 4096 4096
ReadX 12944 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12945
Close 12945
Close 12944
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12948
Close 12948
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12950
Close 12950
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12951
Close 12951
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12954
Close 12954
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12956
Close 12956
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12957
Close 12957
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12960
Close 12960
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12964
Close 12964
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12968
Close 12968
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12972
Close 12972
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12976
Close 12976
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12980
Close 12980
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12983
Close 12983
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12987
Close 12987
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12991
Close 12991
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 12993
Close 12993
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 12994
Close 12994
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13003
Close 13003
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13004
FIND_FIRST \clients\client1\~dmtmp\*
Close 13004
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13005
Close 13005
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13006
ReadX 13006 0 4096 4096
Close 13006
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13007
ReadX 13007 0 4096 4096
Close 13007
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13008
ReadX 13008 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13018
Close 13018
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13019
FIND_FIRST \clients\client1\~dmtmp\*
Close 13019
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13020
Close 13020
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13021
ReadX 13021 0 4096 4096
Close 13021
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13022
ReadX 13022 0 4096 4096
Close 13022
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13023
ReadX 13023 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13024
ReadX 13024 0 65471 65471
ReadX 13024 65471 65 65
ReadX 13024 65536 65471 65471
ReadX 13024 131007 65 65
ReadX 13024 131072 65471 65471
ReadX 13024 196543 65 65
ReadX 13024 196608 65471 65471
ReadX 13024 262079 65 65
ReadX 13024 262144 65471 65471
ReadX 13024 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13025
ReadX 13025 0 65471 65471
ReadX 13025 65471 65 65
ReadX 13025 65536 65471 65471
ReadX 13025 131007 65 65
ReadX 13025 131072 65471 65471
ReadX 13025 196543 65 65
ReadX 13025 196608 65471 65471
ReadX 13025 262079 65 65
ReadX 13025 262144 65471 65471
ReadX 13025 327615 65 65
ReadX 13025 327680 65471 65471
ReadX 13025 393151 65 65
ReadX 13025 393216 65471 65471
ReadX 13025 458687 65 65
ReadX 13025 458752 65471 65471
ReadX 13025 524223 65 65
ReadX 13025 524288 65471 65471
ReadX 13025 589759 65 65
ReadX 13025 589824 65471 65471
ReadX 13025 655295 65 65
ReadX 13025 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13026
ReadX 13026 0 65471 65471
ReadX 13026 65471 65 65
ReadX 13026 65536 65471 65471
ReadX 13026 131007 65 65
ReadX 13026 131072 65471 65471
ReadX 13026 196543 65 65
ReadX 13026 196608 65471 65471
ReadX 13026 262079 65 65
ReadX 13026 262144 65471 65471
ReadX 13026 327615 65 65
ReadX 13026 327680 65471 65471
ReadX 13026 393151 65 65
ReadX 13026 393216 65471 65471
ReadX 13026 458687 65 65
ReadX 13026 458752 65471 65471
ReadX 13026 524223 65 65
ReadX 13026 524288 65471 65471
ReadX 13026 589759 65 65
ReadX 13026 589824 65471 65471
ReadX 13026 655295 65 65
ReadX 13026 655360 65471 65471
ReadX 13026 720831 65 65
ReadX 13026 720896 65471 65471
Close 13008
ReadX 13026 786367 65 65
ReadX 13026 786432 65471 65471
Close 13023
ReadX 13026 851903 65 65
ReadX 13026 851968 65471 65471
Close 13024
ReadX 13026 917439 65 65
ReadX 13026 917504 65471 65471
Close 13025
ReadX 13026 982975 65 65
ReadX 13026 983040 65471 65471
ReadX 13026 1048511 65 65
ReadX 13026 1048576 65471 65471
ReadX 13026 1114047 65 65
ReadX 13026 1114112 65471 65471
ReadX 13026 1179583 65 65
ReadX 13026 1179648 65471 65471
ReadX 13026 1245119 65 65
ReadX 13026 1245184 65471 65471
ReadX 13026 1310655 65 65
ReadX 13026 1310720 65471 65471
ReadX 13026 1376191 65 65
ReadX 13026 1376256 65471 65471
ReadX 13026 1441727 65 65
ReadX 13026 1441792 65471 65471
ReadX 13026 1507263 65 65
ReadX 13026 1507328 65471 65471
ReadX 13026 1572799 65 65
ReadX 13026 1572864 65471 65471
ReadX 13026 1638335 65 65
ReadX 13026 1638400 65471 65471
ReadX 13026 1703871 65 65
ReadX 13026 1703936 65471 65471
ReadX 13026 1769407 65 65
ReadX 13026 1769472 65471 65471
ReadX 13026 1834943 65 65
ReadX 13026 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13027
ReadX 13027 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13027 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13027 8192 4096 4096
ReadX 13027 12288 4096 4096
ReadX 13027 16384 4096 4096
ReadX 13027 20480 4096 4096
ReadX 13027 24576 4096 4096
ReadX 13027 28672 4096 4096
ReadX 13027 32768 4096 4096
ReadX 13027 36864 4096 4096
ReadX 13027 40960 4096 4096
ReadX 13027 45056 4096 4096
ReadX 13027 49152 4096 4096
ReadX 13027 53248 4096 4096
ReadX 13027 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13027 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13028
Close 13028
Close 13026
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13029
WriteX 13029 1535 1 1
QUERY_FILE_INFORMATION 13029
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13027 0 4096 4096
ReadX 13027 4096 4096 4096
QUERY_FILE_INFORMATION 13029
WriteX 13029 0 57088 57088
WriteX 13029 0 4096 4096
Flush 13029
Close 13027
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13030
Close 13030
WriteX 13029 0 4096 4096
Close 13029
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13031
Close 13031
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13032
ReadX 13032 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13032 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13033
WriteX 13033 1535 1 1
QUERY_FILE_INFORMATION 13033
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13032 0 4096 4096
QUERY_FILE_INFORMATION 13033
WriteX 13033 0 51456 51456
WriteX 13033 0 4096 4096
Flush 13033
Close 13032
WriteX 13033 0 4096 4096
Close 13033
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13034
Close 13034
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13035
ReadX 13035 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13035 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13037
Close 13037
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13039
WriteX 13039 4045 1 1
QUERY_FILE_INFORMATION 13039
WriteX 13039 0 53077 53077
Close 13039
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13040
WriteX 13040 1535 1 1
QUERY_FILE_INFORMATION 13040
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13035 0 4096 4096
QUERY_FILE_INFORMATION 13040
WriteX 13040 0 65471 65471
WriteX 13040 65471 65 65
WriteX 13040 65536 1856 1856
WriteX 13040 0 4096 4096
Flush 13040
Close 13035
WriteX 13040 0 4096 4096
Close 13040
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13041
Close 13041
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13042
ReadX 13042 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13044
Close 13044
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13046
WriteX 13046 4076 1 1
QUERY_FILE_INFORMATION 13046
WriteX 13046 0 7983 7983
Close 13046
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13048
Close 13048
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13050
WriteX 13050 4095 1 1
QUERY_FILE_INFORMATION 13050
WriteX 13050 0 65471 65471
WriteX 13050 65471 65 65
WriteX 13050 65536 65471 65471
WriteX 13050 131007 65 65
WriteX 13050 131072 65471 65471
WriteX 13050 196543 65 65
WriteX 13050 196608 65471 65471
WriteX 13050 262079 65 65
WriteX 13050 262144 65471 65471
WriteX 13050 327615 65 65
WriteX 13050 327680 65471 65471
WriteX 13050 393151 65 65
WriteX 13050 393216 65471 65471
WriteX 13050 458687 65 65
WriteX 13050 458752 46731 46731
Close 13050
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13051
WriteX 13051 1535 1 1
QUERY_FILE_INFORMATION 13051
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13042 0 4096 4096
ReadX 13042 4096 4096 4096
QUERY_FILE_INFORMATION 13051
WriteX 13051 0 65471 65471
WriteX 13051 65471 65 65
WriteX 13051 65536 22848 22848
WriteX 13051 0 4096 4096
Flush 13051
Close 13042
WriteX 13051 0 4096 4096
Close 13051
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13052
Close 13052
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13053
ReadX 13053 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13053 4096 4096 4096
Close 13053
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13054
ReadX 13054 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13054 0 8192 8192
ReadX 13054 8192 4096 4096
ReadX 13054 12288 4096 4096
ReadX 13054 16384 4096 4096
ReadX 13054 20480 4096 4096
ReadX 13054 24576 4096 4096
ReadX 13054 28672 4096 4096
ReadX 13054 32768 4096 4096
ReadX 13054 36864 4096 4096
ReadX 13054 40960 4096 4096
ReadX 13054 45056 4096 4096
ReadX 13054 49152 4096 4096
ReadX 13054 53248 4096 4096
ReadX 13054 57344 4096 4096
ReadX 13054 61440 4096 4096
ReadX 13054 65536 4096 4096
ReadX 13054 69632 4096 4096
ReadX 13054 73728 4096 4096
ReadX 13054 77824 4096 4096
ReadX 13054 81920 4096 4096
ReadX 13054 86016 4096 4096
ReadX 13054 90112 4096 4096
ReadX 13054 94208 4096 4096
ReadX 13054 98304 4096 4096
ReadX 13054 102400 4096 4096
ReadX 13054 106496 4096 4096
ReadX 13054 110592 4096 4096
ReadX 13054 114688 4096 4096
ReadX 13054 118784 4096 4096
ReadX 13054 122880 4096 4096
ReadX 13054 126976 4096 4096
ReadX 13054 131072 4096 4096
ReadX 13054 135168 4096 4096
ReadX 13054 139264 4096 4096
ReadX 13054 143360 4096 4096
ReadX 13054 147456 4096 4096
ReadX 13054 151552 4096 4096
ReadX 13054 155648 4096 4096
ReadX 13054 159744 4096 4096
ReadX 13054 163840 4096 4096
ReadX 13054 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13054 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13055
Close 13055
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13056
WriteX 13056 2047 1 1
QUERY_FILE_INFORMATION 13056
Close 13054
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13057
Close 13057
WriteX 13056 0 42388 42388
Close 13056
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13058
Close 13058
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13059
ReadX 13059 0 4096 4096
ReadX 13059 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13060
WriteX 13060 2047 1 1
QUERY_FILE_INFORMATION 13060
Close 13059
WriteX 13060 0 42652 42652
Close 13060
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13061
Close 13061
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13062
ReadX 13062 0 4096 4096
ReadX 13062 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13064
Close 13064
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13066
WriteX 13066 4080 1 1
QUERY_FILE_INFORMATION 13066
WriteX 13066 0 65471 65471
WriteX 13066 65471 65 65
WriteX 13066 65536 49 49
Close 13066
Close 13062
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13067
ReadX 13067 61440 4096 4096
ReadX 13067 126976 4096 4096
WriteX 13067 0 65471 65471
WriteX 13067 65471 65 65
WriteX 13067 65536 65471 65471
WriteX 13067 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13068
ReadX 13068 61440 4096 4096
ReadX 13068 126976 4096 4096
ReadX 13068 192512 4096 4096
ReadX 13068 258048 4096 4096
WriteX 13068 0 65471 65471
WriteX 13068 65471 65 65
WriteX 13068 65536 65471 65471
WriteX 13068 131007 65 65
WriteX 13068 131072 65471 65471
WriteX 13068 196543 65 65
WriteX 13068 196608 65471 65471
WriteX 13068 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13069
ReadX 13069 61440 4096 4096
ReadX 13069 126976 4096 4096
ReadX 13069 192512 4096 4096
ReadX 13069 258048 4096 4096
ReadX 13069 323584 4096 4096
ReadX 13069 389120 4096 4096
ReadX 13069 454656 4096 4096
ReadX 13069 520192 4096 4096
WriteX 13069 0 65471 65471
WriteX 13069 65471 65 65
WriteX 13069 65536 65471 65471
WriteX 13069 131007 65 65
WriteX 13069 131072 65471 65471
WriteX 13069 196543 65 65
WriteX 13069 196608 65471 65471
WriteX 13069 262079 65 65
WriteX 13069 262144 65471 65471
WriteX 13069 327615 65 65
WriteX 13069 327680 65471 65471
WriteX 13069 393151 65 65
WriteX 13069 393216 65471 65471
WriteX 13069 458687 65 65
WriteX 13069 458752 65471 65471
WriteX 13069 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13070
FIND_FIRST \clients\client1\~dmtmp\*
Close 13070
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13071
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13071 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13072
ReadX 13072 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13073
ReadX 13073 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13074
ReadX 13074 0 4096 4096
ReadX 13071 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13071
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13075
ReadX 13075 0 4096 4096
ReadX 13075 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13076
FIND_FIRST \clients\client1\~dmtmp\*
Close 13076
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13077
QUERY_FILE_INFORMATION 13077
WriteX 13077 2047 1 1
QUERY_FILE_INFORMATION 13077
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13078
Close 13078
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13079
WriteX 13079 52 1 1
QUERY_FILE_INFORMATION 13079
WriteX 13079 0 491 491
Close 13079
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13080
ReadX 13080 0 491 491
WriteX 13077 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13075
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13081
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13081 0 4096 4096
ReadX 13081 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13083
Close 13083
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13084
WriteX 13084 52 1 1
QUERY_FILE_INFORMATION 13084
WriteX 13084 0 543 543
Close 13084
Close 13081
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13085
ReadX 13085 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13086
ReadX 13086 0 543 543
ReadX 13085 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13085
Close 13080
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13067
Close 13068
Close 13069
Close 13086
Close 13072
Close 13073
Close 13074
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13077
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13087
FIND_FIRST \clients\client1\~dmtmp\*
Close 13087
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13088
ReadX 13088 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13089
ReadX 13089 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13090
ReadX 13090 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13091
ReadX 13091 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13092
ReadX 13092 0 543 543
ReadX 13088 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13096
FIND_FIRST \clients\client1\~dmtmp\*
Close 13096
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13097
QUERY_FILE_INFORMATION 13097
WriteX 13097 2047 1 1
QUERY_FILE_INFORMATION 13097
WriteX 13097 0 2048 2048
Close 13097
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13098
ReadX 13098 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13098
Close 13088
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13099
ReadX 13099 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13099 4095 1 1
QUERY_FILE_INFORMATION 13099
ReadX 13099 0 4096 4096
WriteX 13099 0 4096 4096
Flush 13099
WriteX 13099 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13100
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13100 0 4096 4096
ReadX 13100 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13104
FIND_FIRST \clients\client1\~dmtmp\*
Close 13104
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13105
WriteX 13105 2047 1 1
QUERY_FILE_INFORMATION 13105
WriteX 13105 0 2048 2048
Close 13105
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13106
ReadX 13106 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13110
Close 13110
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13111
WriteX 13111 2047 1 1
QUERY_FILE_INFORMATION 13111
WriteX 13111 0 2048 2048
Close 13111
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13112
ReadX 13112 0 2048 2048
ReadX 13100 4096 16384 16384
Close 13112
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13113
ReadX 13113 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13113
Close 13092
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13106 4095 1 1
QUERY_FILE_INFORMATION 13106
ReadX 13106 0 4096 4096
WriteX 13106 0 4096 4096
Close 13106
WriteX 13100 0 8192 8192
Close 13100
WriteX 13089 0 4096 4096
WriteX 13090 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13115
ReadX 13115 0 4096 4096
ReadX 13115 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13115
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13116
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13116 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13117
ReadX 13117 0 543 543
ReadX 13116 0 4096 4096
Close 13116
Close 13099
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13118
QUERY_FILE_INFORMATION 13118
Close 13118
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13117
Close 13089
Close 13090
Close 13091
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13119
FIND_FIRST \clients\client1\~dmtmp\*
Close 13119
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13120
ReadX 13120 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13121
ReadX 13121 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13122
ReadX 13122 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13123
ReadX 13123 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13124
ReadX 13124 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13125
ReadX 13125 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13126
ReadX 13126 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13127
ReadX 13127 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13128
ReadX 13128 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13129
ReadX 13129 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13130
ReadX 13130 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13131
ReadX 13131 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13132
ReadX 13132 0 4096 4096
ReadX 13120 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13136
FIND_FIRST \clients\client1\~dmtmp\*
Close 13136
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13137
QUERY_FILE_INFORMATION 13137
WriteX 13137 2047 1 1
QUERY_FILE_INFORMATION 13137
WriteX 13137 0 2048 2048
Close 13137
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13138
ReadX 13138 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13138
Close 13128
Close 13120
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13139
ReadX 13139 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13140
FIND_FIRST \clients\client1\~dmtmp\*
Close 13140
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13141
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13141 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13142
ReadX 13142 0 4096 4096
ReadX 13141 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13146
FIND_FIRST \clients\client1\~dmtmp\*
Close 13146
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13147
QUERY_FILE_INFORMATION 13147
WriteX 13147 2047 1 1
QUERY_FILE_INFORMATION 13147
WriteX 13147 0 2048 2048
Close 13147
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13148
ReadX 13148 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13148
Close 13141
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13149
ReadX 13149 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13139 4095 1 1
QUERY_FILE_INFORMATION 13139
ReadX 13139 0 4096 4096
WriteX 13139 0 4096 4096
Flush 13139
WriteX 13149 4095 1 1
QUERY_FILE_INFORMATION 13149
ReadX 13149 0 4096 4096
WriteX 13149 0 4096 4096
Flush 13149
WriteX 13139 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 13149 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13150
ReadX 13150 0 4096 4096
ReadX 13142 0 4096 4096
ReadX 13150 0 4096 4096
ReadX 13150 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13151
FIND_FIRST \clients\client1\~dmtmp\*
Close 13151
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13152
WriteX 13152 4095 1 1
QUERY_FILE_INFORMATION 13152
WriteX 13152 0 4096 4096
Close 13152
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13153
ReadX 13153 0 4096 4096
Close 13150
Close 13142
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13154
Close 13154
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13155
WriteX 13155 4095 1 1
QUERY_FILE_INFORMATION 13155
WriteX 13155 0 4096 4096
Close 13155
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13156
ReadX 13156 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 13156 0 4096 4096
Close 13153
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13132
Close 13126
Close 13129
Close 13130
Close 13131
Close 13127
Close 13121
Close 13124
Close 13125
Close 13122
Close 13123
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13156
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13158
Close 13158
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13159
ReadX 13159 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13160
Close 13160
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13161
WriteX 13161 2047 1 1
QUERY_FILE_INFORMATION 13161
WriteX 13161 0 2048 2048
Close 13161
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13162
ReadX 13162 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13162
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13163
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13163 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13164
ReadX 13164 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13165
ReadX 13165 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13166
ReadX 13166 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13167
ReadX 13167 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13168
ReadX 13168 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13169
ReadX 13169 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13170
ReadX 13170 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13171
ReadX 13171 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13172
ReadX 13172 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13173
ReadX 13173 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13174
ReadX 13174 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13175
ReadX 13175 0 4096 4096
ReadX 13163 0 4096 4096
ReadX 13170 0 4096 4096
Close 13170
Close 13163
Close 13139
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13176
QUERY_FILE_INFORMATION 13176
Close 13176
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13159
Close 13174
Close 13169
Close 13171
Close 13172
Close 13173
Close 13175
Close 13164
Close 13167
Close 13168
Close 13165
Close 13166
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13149
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13177
QUERY_FILE_INFORMATION 13177
Close 13177
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13178
FIND_FIRST \clients\client1\~dmtmp\*
Close 13178
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13179
ReadX 13179 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13180
ReadX 13180 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13181
ReadX 13181 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13182
ReadX 13182 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13183
ReadX 13183 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13184
ReadX 13184 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13185
ReadX 13185 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13186
ReadX 13186 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13187
ReadX 13187 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13188
ReadX 13188 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13189
ReadX 13189 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13190
ReadX 13190 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13191
ReadX 13191 0 4096 4096
ReadX 13179 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13195
FIND_FIRST \clients\client1\~dmtmp\*
Close 13195
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13196
QUERY_FILE_INFORMATION 13196
WriteX 13196 2047 1 1
QUERY_FILE_INFORMATION 13196
WriteX 13196 0 2048 2048
Close 13196
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13197
ReadX 13197 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13197
Close 13179
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13198
ReadX 13198 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13199
FIND_FIRST \clients\client1\~dmtmp\*
Close 13199
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13200
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13200 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13201
ReadX 13201 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13202
ReadX 13202 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13203
ReadX 13203 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13204
ReadX 13204 0 543 543
ReadX 13200 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13208
FIND_FIRST \clients\client1\~dmtmp\*
Close 13208
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13209
QUERY_FILE_INFORMATION 13209
WriteX 13209 2047 1 1
QUERY_FILE_INFORMATION 13209
WriteX 13209 0 2048 2048
Close 13209
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13210
ReadX 13210 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13210
Close 13200
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13211
ReadX 13211 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 13184
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13212
FIND_FIRST \clients\client1\~dmtmp\*
Close 13212
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13213
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13213 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13214
ReadX 13214 0 4096 4096
ReadX 13213 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13218
FIND_FIRST \clients\client1\~dmtmp\*
Close 13218
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13219
QUERY_FILE_INFORMATION 13219
WriteX 13219 2047 1 1
QUERY_FILE_INFORMATION 13219
WriteX 13219 0 2048 2048
Close 13219
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13220
ReadX 13220 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13220
Close 13214
Close 13213
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13221
ReadX 13221 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13198 4095 1 1
QUERY_FILE_INFORMATION 13198
ReadX 13198 0 4096 4096
WriteX 13198 0 4096 4096
Flush 13198
WriteX 13211 4095 1 1
QUERY_FILE_INFORMATION 13211
ReadX 13211 0 4096 4096
WriteX 13211 0 4096 4096
Flush 13211
WriteX 13221 4095 1 1
QUERY_FILE_INFORMATION 13221
ReadX 13221 0 4096 4096
WriteX 13221 0 4096 4096
Flush 13221
WriteX 13198 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 13211 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 13221 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13222
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13222 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13223
ReadX 13223 0 4096 4096
ReadX 13222 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13224
ReadX 13224 0 4096 4096
ReadX 13224 0 4096 4096
ReadX 13224 4096 16384 16384
ReadX 13222 4096 16384 16384
ReadX 13222 0 4096 4096
ReadX 13223 0 4096 4096
ReadX 13223 4096 4096 4096
Close 13224
Close 13223
Close 13222
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13225
FIND_FIRST \clients\client1\~dmtmp\*
Close 13225
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13226
ReadX 13226 0 2048 2048
WriteX 13226 18431 1 1
QUERY_FILE_INFORMATION 13226
WriteX 13226 0 19584 19584
Close 13226
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13227
ReadX 13227 0 4096 4096
ReadX 13227 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13227
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13228
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13228 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13229
ReadX 13229 0 4096 4096
ReadX 13228 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13230
ReadX 13230 0 4096 4096
ReadX 13230 0 4096 4096
Close 13230
Close 13229
Close 13228
Close 13198
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13231
QUERY_FILE_INFORMATION 13231
Close 13231
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13204
Close 13191
Close 13183
Close 13201
Close 13202
Close 13203
Close 13190
Close 13185
Close 13188
Close 13189
Close 13186
Close 13187
Close 13180
Close 13181
Close 13182
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13211
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13232
QUERY_FILE_INFORMATION 13232
Close 13232
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13221
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13233
QUERY_FILE_INFORMATION 13233
Close 13233
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13234
FIND_FIRST \clients\client1\~dmtmp\*
Close 13234
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13235
ReadX 13235 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13236
ReadX 13236 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13237
ReadX 13237 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13238
ReadX 13238 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13239
ReadX 13239 0 543 543
ReadX 13235 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13235 4096 16384 16384
WriteX 13235 0 4096 4096
Close 13235
WriteX 13236 0 4096 4096
WriteX 13237 0 4096 4096
WriteX 13238 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13240
FIND_FIRST \clients\client1\~dmtmp\*
Close 13240
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13241
ReadX 13241 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13242
ReadX 13242 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13243
ReadX 13243 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13244
ReadX 13244 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13245
ReadX 13245 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13246
ReadX 13246 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13247
ReadX 13247 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13248
ReadX 13248 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13249
ReadX 13249 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13250
ReadX 13250 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13251
ReadX 13251 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13252
ReadX 13252 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13253
ReadX 13253 0 4096 4096
ReadX 13241 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13254
ReadX 13254 0 8192 8192
ReadX 13241 4096 16384 16384
Close 13248
Close 13241
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13255
FIND_FIRST \clients\client1\~dmtmp\*
Close 13255
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13256
ReadX 13256 0 4096 4096
ReadX 13256 4096 4096 4096
ReadX 13256 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13257
ReadX 13257 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13258
ReadX 13258 0 4096 4096
ReadX 13257 0 4096 4096
ReadX 13257 0 4096 4096
ReadX 13257 4096 16384 16384
Close 13258
WriteX 13257 0 4096 4096
Close 13257
WriteX 13242 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13259
FIND_FIRST \clients\client1\~dmtmp\*
Close 13259
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13260
ReadX 13260 0 4096 4096
ReadX 13260 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13261
ReadX 13261 0 4096 4096
ReadX 13261 0 4096 4096
WriteX 13261 0 4096 4096
Close 13261
WriteX 13236 0 4096 4096
WriteX 13237 0 4096 4096
WriteX 13238 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13262
ReadX 13262 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13263
ReadX 13263 0 4096 4096
ReadX 13262 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13267
FIND_FIRST \clients\client1\~dmtmp\*
Close 13267
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13268
QUERY_FILE_INFORMATION 13268
WriteX 13268 2047 1 1
QUERY_FILE_INFORMATION 13268
WriteX 13268 0 2048 2048
Close 13268
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13269
ReadX 13269 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13269 4095 1 1
QUERY_FILE_INFORMATION 13269
ReadX 13269 0 4096 4096
WriteX 13269 0 4096 4096
Close 13269
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13270
ReadX 13270 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13270 0 4096 4096
Close 13263
Close 13262
WriteX 13270 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13271
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13271 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13272
ReadX 13272 0 4096 4096
ReadX 13271 0 4096 4096
ReadX 13271 4096 16384 16384
Close 13272
Close 13271
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13273
FIND_FIRST \clients\client1\~dmtmp\*
Close 13273
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13274
ReadX 13274 0 4096 4096
ReadX 13274 4096 4096 4096
WriteX 13274 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13274 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13274
ReadX 13270 0 4096 4096
WriteX 13270 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13275
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13275 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13276
ReadX 13276 0 4096 4096
ReadX 13275 0 4096 4096
ReadX 13275 4096 16384 16384
Close 13276
Close 13275
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13277
FIND_FIRST \clients\client1\~dmtmp\*
Close 13277
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13278
ReadX 13278 0 4096 4096
ReadX 13278 4096 4096 4096
WriteX 13278 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13278 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13278
Close 13270
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13279
QUERY_FILE_INFORMATION 13279
Close 13279
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13254
Close 13256
Close 13260
Close 13239
Close 13236
Close 13237
Close 13238
Close 13247
Close 13252
Close 13249
Close 13250
Close 13251
Close 13253
Close 13242
Close 13245
Close 13246
Close 13243
Close 13244
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13280
FIND_FIRST \clients\client1\~dmtmp\*
Close 13280
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13281
ReadX 13281 0 4096 4096
ReadX 13281 4096 4096 4096
ReadX 13281 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13282
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13282 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13283
ReadX 13283 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13284
ReadX 13284 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13285
ReadX 13285 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13286
ReadX 13286 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13287
ReadX 13287 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13288
ReadX 13288 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13289
ReadX 13289 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13290
ReadX 13290 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13291
ReadX 13291 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13292
ReadX 13292 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13293
ReadX 13293 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13294
ReadX 13294 0 4096 4096
ReadX 13282 0 4096 4096
ReadX 13282 0 4096 4096
ReadX 13282 4096 16384 16384
Close 13289
Close 13282
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13295
ReadX 13295 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13296
ReadX 13296 0 4096 4096
ReadX 13295 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13300
FIND_FIRST \clients\client1\~dmtmp\*
Close 13300
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13301
QUERY_FILE_INFORMATION 13301
WriteX 13301 2047 1 1
QUERY_FILE_INFORMATION 13301
WriteX 13301 0 2048 2048
Close 13301
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13302
ReadX 13302 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13302 4095 1 1
QUERY_FILE_INFORMATION 13302
ReadX 13302 0 4096 4096
WriteX 13302 0 4096 4096
Close 13302
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13303
ReadX 13303 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13303 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13307
Close 13307
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13308
QUERY_FILE_INFORMATION 13308
WriteX 13308 2047 1 1
QUERY_FILE_INFORMATION 13308
WriteX 13308 0 2048 2048
Close 13308
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13309
ReadX 13309 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13309 4095 1 1
QUERY_FILE_INFORMATION 13309
ReadX 13309 0 4096 4096
WriteX 13309 0 4096 4096
Close 13309
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13310
ReadX 13310 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13310 0 4096 4096
Close 13295
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13311
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13311 0 4096 4096
ReadX 13311 0 4096 4096
ReadX 13311 4096 16384 16384
Close 13311
Close 13303
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13312
QUERY_FILE_INFORMATION 13312
Close 13312
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13281
Close 13293
Close 13288
Close 13294
Close 13296
Close 13283
Close 13286
Close 13287
Close 13284
Close 13285
Close 13290
Close 13291
Close 13292
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13310
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13313
QUERY_FILE_INFORMATION 13313
Close 13313
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13314
ReadX 13314 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13315
Close 13315
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13316
WriteX 13316 63 1 1
QUERY_FILE_INFORMATION 13316
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13314 0 4096 4096
ReadX 13314 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13314 0 8192 8192
Flush 13314
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13314 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13314 0 8192 8192
Flush 13314
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13314 0 8192 8192
Flush 13314
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13314 0 8192 8192
Flush 13314
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13318
Close 13318
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13320
WriteX 13320 4065 1 1
QUERY_FILE_INFORMATION 13320
WriteX 13320 0 62591 62591
Close 13320
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13322
Close 13322
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13324
WriteX 13324 4094 1 1
QUERY_FILE_INFORMATION 13324
WriteX 13324 0 10845 10845
Close 13324
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13326
Close 13326
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13328
WriteX 13328 4081 1 1
QUERY_FILE_INFORMATION 13328
WriteX 13328 0 30118 30118
Close 13328
WriteX 13314 0 4096 4096
Close 13314
WriteX 13316 0 64 64
Close 13316
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13329
ReadX 13329 61440 4096 4096
ReadX 13329 126976 4096 4096
WriteX 13329 0 65471 65471
WriteX 13329 65471 65 65
WriteX 13329 65536 65471 65471
WriteX 13329 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13330
ReadX 13330 61440 4096 4096
ReadX 13330 126976 4096 4096
ReadX 13330 192512 4096 4096
ReadX 13330 258048 4096 4096
WriteX 13330 0 65471 65471
WriteX 13330 65471 65 65
WriteX 13330 65536 65471 65471
WriteX 13330 131007 65 65
WriteX 13330 131072 65471 65471
WriteX 13330 196543 65 65
WriteX 13330 196608 65471 65471
WriteX 13330 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13331
ReadX 13331 61440 4096 4096
ReadX 13331 126976 4096 4096
ReadX 13331 192512 4096 4096
ReadX 13331 258048 4096 4096
ReadX 13331 323584 4096 4096
ReadX 13331 389120 4096 4096
ReadX 13331 454656 4096 4096
ReadX 13331 520192 4096 4096
WriteX 13331 0 65471 65471
WriteX 13331 65471 65 65
WriteX 13331 65536 65471 65471
WriteX 13331 131007 65 65
WriteX 13331 131072 65471 65471
WriteX 13331 196543 65 65
WriteX 13331 196608 65471 65471
WriteX 13331 262079 65 65
WriteX 13331 262144 65471 65471
WriteX 13331 327615 65 65
WriteX 13331 327680 65471 65471
WriteX 13331 393151 65 65
WriteX 13331 393216 65471 65471
WriteX 13331 458687 65 65
WriteX 13331 458752 65471 65471
WriteX 13331 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13332
Close 13332
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13329
Close 13330
Close 13331
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13333
ReadX 13333 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13334
ReadX 13334 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13335
ReadX 13335 0 4096 4096
ReadX 13335 4096 4096 4096
ReadX 13335 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13336
Close 13336
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13333
Close 13334
Close 13335
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13337
Close 13337
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13338
ReadX 13338 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13339
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13339
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13340
Close 13340
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13341
ReadX 13341 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13342
Close 13342
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13338
Close 13341
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13343
Close 13343
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13344
ReadX 13344 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13345
ReadX 13345 0 8192 8192
ReadX 13345 8192 8192 8192
ReadX 13345 16384 8192 8192
ReadX 13345 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13347
Close 13347
Close 13344
Close 13345
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13349
WriteX 13349 8191 1 1
QUERY_FILE_INFORMATION 13349
WriteX 13349 0 10438 10438
Close 13349
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13350
Close 13350
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13351
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13352
Close 13352
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13353
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13354
Close 13354
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13355
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13356
FIND_FIRST \clients\client1\~dmtmp\*
Close 13356
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13357
Close 13357
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13358
ReadX 13358 0 4096 4096
Close 13358
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13359
ReadX 13359 0 8192 8192
Close 13359
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13360
ReadX 13360 0 8192 8192
ReadX 13360 8192 4096 4096
ReadX 13360 12288 8192 8192
ReadX 13360 20480 8192 8192
ReadX 13360 28672 8192 8192
ReadX 13360 36864 8192 8192
ReadX 13360 45056 8192 8192
ReadX 13360 53248 8192 8192
ReadX 13360 61440 8192 8192
ReadX 13360 69632 8192 8192
ReadX 13360 77824 8192 8192
ReadX 13360 86016 8192 8192
ReadX 13360 94208 8192 8192
ReadX 13360 102400 8192 8192
ReadX 13360 110592 8192 8192
ReadX 13360 118784 8192 8192
ReadX 13360 126976 8192 8192
ReadX 13360 135168 8192 8192
ReadX 13360 143360 8192 8192
ReadX 13360 151552 8192 8192
ReadX 13360 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13361
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13361
Close 13360
Close 13351
Close 13353
Close 13355
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13362
Close 13362
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13364
WriteX 13364 8191 1 1
QUERY_FILE_INFORMATION 13364
WriteX 13364 0 28489 28489
Close 13364
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13365
Close 13365
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13366
FIND_FIRST \clients\client1\~dmtmp\*
Close 13366
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13367
Close 13367
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13368
ReadX 13368 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13369
Close 13369
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13368
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13370
Close 13370
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13371
ReadX 13371 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13372
ReadX 13372 0 8192 8192
ReadX 13372 8192 8192 8192
ReadX 13372 16384 8192 8192
ReadX 13372 24576 8192 8192
ReadX 13372 32768 16384 16384
ReadX 13372 49152 8192 8192
ReadX 13372 57344 8192 8192
ReadX 13372 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13374
Close 13374
Close 13371
Close 13372
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13376
WriteX 13376 8191 1 1
QUERY_FILE_INFORMATION 13376
WriteX 13376 0 29253 29253
Close 13376
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13377
Close 13377
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13378
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13379
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13379
Close 13378
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13380
Close 13380
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13382
WriteX 13382 8191 1 1
QUERY_FILE_INFORMATION 13382
WriteX 13382 0 30183 30183
Close 13382
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13383
Close 13383
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13384
WriteX 13384 0 510 510
WriteX 13384 510 512 512
WriteX 13384 1022 510 510
WriteX 13384 1532 510 510
WriteX 13384 2042 168 168
Close 13384
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13385
Close 13385
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13386
ReadX 13386 0 4096 4096
WriteX 13386 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13387
ReadX 13387 0 65471 65471
ReadX 13387 65471 65 65
ReadX 13387 65536 65471 65471
ReadX 13387 131007 65 65
ReadX 13387 131072 65471 65471
ReadX 13387 196543 65 65
ReadX 13387 196608 65471 65471
ReadX 13387 262079 65 65
ReadX 13387 262144 65471 65471
ReadX 13387 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13388
ReadX 13388 0 65471 65471
ReadX 13388 65471 65 65
ReadX 13388 65536 65471 65471
ReadX 13388 131007 65 65
ReadX 13388 131072 65471 65471
ReadX 13388 196543 65 65
ReadX 13388 196608 65471 65471
ReadX 13388 262079 65 65
ReadX 13388 262144 65471 65471
ReadX 13388 327615 65 65
ReadX 13388 327680 65471 65471
ReadX 13388 393151 65 65
ReadX 13388 393216 65471 65471
ReadX 13388 458687 65 65
ReadX 13388 458752 65471 65471
ReadX 13388 524223 65 65
ReadX 13388 524288 65471 65471
ReadX 13388 589759 65 65
ReadX 13388 589824 65471 65471
ReadX 13388 655295 65 65
ReadX 13388 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13389
ReadX 13389 0 65471 65471
ReadX 13389 65471 65 65
ReadX 13389 65536 65471 65471
ReadX 13389 131007 65 65
ReadX 13389 131072 65471 65471
ReadX 13389 196543 65 65
ReadX 13389 196608 65471 65471
ReadX 13389 262079 65 65
ReadX 13389 262144 65471 65471
ReadX 13389 327615 65 65
ReadX 13389 327680 65471 65471
ReadX 13389 393151 65 65
ReadX 13389 393216 65471 65471
ReadX 13389 458687 65 65
ReadX 13389 458752 65471 65471
ReadX 13389 524223 65 65
ReadX 13389 524288 65471 65471
ReadX 13389 589759 65 65
ReadX 13389 589824 65471 65471
ReadX 13389 655295 65 65
ReadX 13389 655360 65471 65471
ReadX 13389 720831 65 65
ReadX 13389 720896 65471 65471
ReadX 13389 786367 65 65
ReadX 13389 786432 65471 65471
ReadX 13389 851903 65 65
ReadX 13389 851968 65471 65471
ReadX 13389 917439 65 65
ReadX 13389 917504 65471 65471
ReadX 13389 982975 65 65
ReadX 13389 983040 65471 65471
ReadX 13389 1048511 65 65
ReadX 13389 1048576 65471 65471
ReadX 13389 1114047 65 65
ReadX 13389 1114112 65471 65471
ReadX 13389 1179583 65 65
ReadX 13389 1179648 65471 65471
ReadX 13389 1245119 65 65
ReadX 13389 1245184 65471 65471
ReadX 13389 1310655 65 65
ReadX 13389 1310720 65471 65471
ReadX 13389 1376191 65 65
ReadX 13389 1376256 65471 65471
ReadX 13389 1441727 65 65
ReadX 13389 1441792 65471 65471
ReadX 13389 1507263 65 65
ReadX 13389 1507328 65471 65471
ReadX 13389 1572799 65 65
ReadX 13389 1572864 65471 65471
ReadX 13389 1638335 65 65
ReadX 13389 1638400 65471 65471
ReadX 13389 1703871 65 65
ReadX 13389 1703936 65471 65471
ReadX 13389 1769407 65 65
ReadX 13389 1769472 65471 65471
ReadX 13389 1834943 65 65
ReadX 13389 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13390
ReadX 13390 0 4096 4096
ReadX 13390 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13391
WriteX 13391 52 1 1
QUERY_FILE_INFORMATION 13391
WriteX 13391 0 53 53
Close 13391
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13392
Close 13392
Close 13386
Close 13387
Close 13388
Close 13389
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13390 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13393
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13390 0 4096 4096
ReadX 13390 4096 4096 4096
ReadX 13390 8192 4096 4096
ReadX 13390 12288 4096 4096
WriteX 13393 15359 1 1
QUERY_FILE_INFORMATION 13393
ReadX 13390 16384 4096 4096
ReadX 13390 20480 4096 4096
WriteX 13393 0 15360 15360
Close 13393
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13394
ReadX 13394 0 4096 4096
WriteX 13394 0 4096 4096
Close 13394
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13395
Close 13395
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13396
ReadX 13396 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13397
Close 13397
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13390
ReadX 13396 0 4096 4096
ReadX 13396 4096 4096 4096
ReadX 13396 8192 4096 4096
ReadX 13396 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13398
ReadX 13398 0 4096 4096
ReadX 13398 0 4096 4096
ReadX 13398 4096 4096 4096
ReadX 13398 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13399
ReadX 13399 0 4096 4096
ReadX 13399 4096 4096 4096
ReadX 13399 8192 4096 4096
Close 13398
Close 13399
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13400
WriteX 13400 15359 1 1
QUERY_FILE_INFORMATION 13400
WriteX 13400 0 15360 15360
Close 13400
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13401
ReadX 13401 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13396
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13402
Close 13402
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13403
ReadX 13403 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13404
Close 13404
WriteX 13401 0 4096 4096
Close 13401
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13405
Close 13405
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13406
ReadX 13406 0 4096 4096
ReadX 13406 0 4096 4096
ReadX 13406 4096 4096 4096
ReadX 13406 8192 4096 4096
ReadX 13406 12288 3072 3072
ReadX 13406 0 8192 8192
ReadX 13406 8192 4096 4096
ReadX 13406 12288 3072 3072
WriteX 13406 15469 1 1
QUERY_FILE_INFORMATION 13406
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13407
ReadX 13407 0 4096 4096
ReadX 13407 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13408
WriteX 13408 52 1 1
QUERY_FILE_INFORMATION 13408
WriteX 13408 0 53 53
Close 13408
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13409
Close 13409
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13410
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13407 0 8192 8192
ReadX 13407 8192 4096 4096
ReadX 13407 12288 4096 4096
WriteX 13410 12005 1 1
QUERY_FILE_INFORMATION 13410
WriteX 13410 0 12006 12006
Close 13410
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13411
ReadX 13411 0 4096 4096
WriteX 13411 0 4096 4096
Close 13411
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13412
Close 13412
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13413
ReadX 13413 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13414
Close 13414
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13407
ReadX 13413 0 4096 4096
ReadX 13413 4096 4096 4096
ReadX 13413 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13415
WriteX 13415 11990 1 1
QUERY_FILE_INFORMATION 13415
WriteX 13415 0 11991 11991
Close 13415
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13416
ReadX 13416 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13413
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13417
Close 13417
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13418
ReadX 13418 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13419
Close 13419
WriteX 13416 0 4096 4096
Close 13416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13420
Close 13420
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13421
ReadX 13421 0 4096 4096
ReadX 13421 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13422
Close 13422
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13421 0 8192 8192
ReadX 13421 8192 3799 3799
WriteX 13421 13247 1 1
QUERY_FILE_INFORMATION 13421
WriteX 13421 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13421 0 8192 8192
ReadX 13421 8192 4096 4096
Close 13403
WriteX 13406 0 19054 19054
Close 13406
WriteX 13421 0 12288 12288
Close 13421
Close 13418
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13423
Close 13423
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13424
Close 13424
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13425
ReadX 13425 61440 4096 4096
ReadX 13425 126976 4096 4096
WriteX 13425 0 65471 65471
WriteX 13425 65471 65 65
WriteX 13425 65536 65471 65471
WriteX 13425 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13426
ReadX 13426 61440 4096 4096
ReadX 13426 126976 4096 4096
ReadX 13426 192512 4096 4096
ReadX 13426 258048 4096 4096
WriteX 13426 0 65471 65471
WriteX 13426 65471 65 65
WriteX 13426 65536 65471 65471
WriteX 13426 131007 65 65
WriteX 13426 131072 65471 65471
WriteX 13426 196543 65 65
WriteX 13426 196608 65471 65471
WriteX 13426 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13427
ReadX 13427 61440 4096 4096
ReadX 13427 126976 4096 4096
ReadX 13427 192512 4096 4096
ReadX 13427 258048 4096 4096
ReadX 13427 323584 4096 4096
ReadX 13427 389120 4096 4096
ReadX 13427 454656 4096 4096
ReadX 13427 520192 4096 4096
WriteX 13427 0 65471 65471
WriteX 13427 65471 65 65
WriteX 13427 65536 65471 65471
WriteX 13427 131007 65 65
WriteX 13427 131072 65471 65471
WriteX 13427 196543 65 65
WriteX 13427 196608 65471 65471
WriteX 13427 262079 65 65
WriteX 13427 262144 65471 65471
WriteX 13427 327615 65 65
WriteX 13427 327680 65471 65471
WriteX 13427 393151 65 65
WriteX 13427 393216 65471 65471
WriteX 13427 458687 65 65
WriteX 13427 458752 65471 65471
WriteX 13427 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13428 0 4096 4096
Close 13428
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13429
ReadX 13429 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13429
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13430
ReadX 13430 0 4096 4096
ReadX 13430 4096 4096 4096
ReadX 13430 8192 4096 4096
ReadX 13430 12288 4096 4096
ReadX 13430 16384 4096 4096
ReadX 13430 20480 4096 4096
ReadX 13430 24576 4096 4096
ReadX 13430 28672 4096 4096
ReadX 13430 32768 4096 4096
ReadX 13430 36864 4096 4096
ReadX 13430 40960 4096 4096
ReadX 13430 45056 4096 4096
ReadX 13430 49152 4096 4096
ReadX 13430 53248 4096 4096
ReadX 13430 57344 4096 4096
ReadX 13430 61440 4096 4096
ReadX 13430 65536 4096 4096
ReadX 13430 69632 4096 4096
ReadX 13430 73728 4096 4096
WriteX 13430 0 4096 4096
Close 13430
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13431
Close 13431
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13432
ReadX 13432 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13433
Close 13433
Close 13425
Close 13426
Close 13427
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13432
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13435
WriteX 13435 4607 1 1
QUERY_FILE_INFORMATION 13435
WriteX 13435 0 65471 65471
WriteX 13435 65471 65 65
WriteX 13435 65536 19979 19979
Close 13435
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13436
ReadX 13436 0 4096 4096
WriteX 13436 0 4096 4096
Flush 13436
WriteX 13436 0 4096 4096
Flush 13436
QUERY_FILE_INFORMATION 13436
WriteX 13436 0 4096 4096
Flush 13436
WriteX 13436 0 4096 4096
Flush 13436
WriteX 13436 0 4096 4096
Flush 13436
WriteX 13436 0 4096 4096
Flush 13436
Close 13436
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13437
ReadX 13437 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13438
ReadX 13438 0 4096 4096
Close 13437
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13439
ReadX 13439 0 4096 4096
Close 13439
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13440
ReadX 13440 0 4096 4096
Close 13440
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13441
ReadX 13441 0 4096 4096
WriteX 13441 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13442
Close 13442
Close 13438
Close 13441
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13443
Close 13443
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13445
WriteX 13445 4607 1 1
QUERY_FILE_INFORMATION 13445
WriteX 13445 0 65471 65471
WriteX 13445 65471 65 65
WriteX 13445 65536 17654 17654
Close 13445
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13446
ReadX 13446 0 4096 4096
WriteX 13446 0 4096 4096
Flush 13446
WriteX 13446 0 4096 4096
Flush 13446
QUERY_FILE_INFORMATION 13446
WriteX 13446 0 4096 4096
Flush 13446
WriteX 13446 0 4096 4096
Flush 13446
WriteX 13446 0 4096 4096
Flush 13446
WriteX 13446 0 4096 4096
Flush 13446
Close 13446
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13447
Close 13447
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13448
ReadX 13448 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13449
Close 13449
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13450
ReadX 13450 0 4096 4096
ReadX 13450 4096 4096 4096
ReadX 13450 8192 4096 4096
ReadX 13450 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13450 16384 4096 4096
ReadX 13450 20480 4096 4096
ReadX 13450 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13448
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13451
ReadX 13451 0 4096 4096
Close 13451
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13452
ReadX 13452 0 4096 4096
Close 13452
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13453
ReadX 13453 0 4096 4096
WriteX 13453 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13454
Close 13454
Close 13453
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13455
Close 13455
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13457
WriteX 13457 4607 1 1
QUERY_FILE_INFORMATION 13457
WriteX 13457 0 65471 65471
WriteX 13457 65471 65 65
WriteX 13457 65536 19490 19490
Close 13457
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13458
ReadX 13458 0 4096 4096
WriteX 13458 0 4096 4096
Flush 13458
WriteX 13458 0 4096 4096
Flush 13458
QUERY_FILE_INFORMATION 13458
WriteX 13458 0 4096 4096
Flush 13458
WriteX 13458 0 4096 4096
Flush 13458
WriteX 13458 0 4096 4096
Flush 13458
WriteX 13458 0 4096 4096
Flush 13458
Close 13458
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13459
Close 13459
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13460
ReadX 13460 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13461
Close 13461
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13460
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13462
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13462 0 4096 4096
Close 13462
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13463
ReadX 13463 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13463
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13464
ReadX 13464 0 4096 4096
ReadX 13464 4096 4096 4096
ReadX 13464 8192 4096 4096
ReadX 13464 12288 4096 4096
ReadX 13464 16384 4096 4096
ReadX 13464 20480 4096 4096
ReadX 13464 24576 4096 4096
ReadX 13464 28672 4096 4096
ReadX 13464 32768 4096 4096
ReadX 13464 36864 4096 4096
ReadX 13464 40960 4096 4096
ReadX 13464 45056 4096 4096
ReadX 13464 49152 4096 4096
ReadX 13464 53248 4096 4096
ReadX 13464 57344 4096 4096
ReadX 13464 61440 4096 4096
ReadX 13464 65536 4096 4096
ReadX 13464 69632 4096 4096
ReadX 13464 73728 4096 4096
WriteX 13464 0 4096 4096
Close 13464
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13465
Close 13465
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13466
ReadX 13466 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13467
Close 13467
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13466
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13469
WriteX 13469 4607 1 1
QUERY_FILE_INFORMATION 13469
WriteX 13469 0 65471 65471
WriteX 13469 65471 65 65
WriteX 13469 65536 8866 8866
Close 13469
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13470
ReadX 13470 0 4096 4096
WriteX 13470 0 4096 4096
Flush 13470
WriteX 13470 0 4096 4096
Flush 13470
Close 13470
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13471
ReadX 13471 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13471
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13472
ReadX 13472 0 4096 4096
Close 13472
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13473
ReadX 13473 0 4096 4096
Close 13473
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13474
ReadX 13474 0 4096 4096
WriteX 13474 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13475
Close 13475
Close 13474
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13476
Close 13476
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13478
WriteX 13478 4607 1 1
QUERY_FILE_INFORMATION 13478
WriteX 13478 0 65471 65471
WriteX 13478 65471 65 65
WriteX 13478 65536 9298 9298
Close 13478
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13479
ReadX 13479 0 4096 4096
WriteX 13479 0 4096 4096
Flush 13479
WriteX 13479 0 4096 4096
Flush 13479
Close 13479
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13480
Close 13480
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13481
ReadX 13481 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13482
Close 13482
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13484
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13484 0 4096 4096
Close 13484
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13485
ReadX 13485 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13485 4096 4096 4096
ReadX 13485 8192 4096 4096
ReadX 13485 12288 4096 4096
ReadX 13485 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13481
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13486
ReadX 13486 0 4096 4096
Close 13486
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13487
ReadX 13487 0 4096 4096
Close 13487
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13488
ReadX 13488 0 4096 4096
WriteX 13488 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13489
Close 13489
Close 13485
Close 13488
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13490
Close 13490
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13492
WriteX 13492 4607 1 1
QUERY_FILE_INFORMATION 13492
WriteX 13492 0 65471 65471
WriteX 13492 65471 65 65
WriteX 13492 65536 11540 11540
Close 13492
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13493
ReadX 13493 0 4096 4096
WriteX 13493 0 4096 4096
Flush 13493
WriteX 13493 0 4096 4096
Flush 13493
Close 13493
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13494
Close 13494
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13495
ReadX 13495 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13496
Close 13496
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13495
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13497
ReadX 13497 0 65471 65471
ReadX 13497 65471 65 65
ReadX 13497 65536 65471 65471
ReadX 13497 131007 65 65
ReadX 13497 131072 65471 65471
ReadX 13497 196543 65 65
ReadX 13497 196608 65471 65471
ReadX 13497 262079 65 65
ReadX 13497 262144 65471 65471
ReadX 13497 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13498
ReadX 13498 0 65471 65471
ReadX 13498 65471 65 65
ReadX 13498 65536 65471 65471
ReadX 13498 131007 65 65
ReadX 13498 131072 65471 65471
ReadX 13498 196543 65 65
ReadX 13498 196608 65471 65471
ReadX 13498 262079 65 65
ReadX 13498 262144 65471 65471
ReadX 13498 327615 65 65
ReadX 13498 327680 65471 65471
ReadX 13498 393151 65 65
ReadX 13498 393216 65471 65471
ReadX 13498 458687 65 65
ReadX 13498 458752 65471 65471
ReadX 13498 524223 65 65
ReadX 13498 524288 65471 65471
ReadX 13498 589759 65 65
ReadX 13498 589824 65471 65471
ReadX 13498 655295 65 65
ReadX 13498 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13499
ReadX 13499 0 65471 65471
ReadX 13499 65471 65 65
ReadX 13499 65536 65471 65471
ReadX 13499 131007 65 65
ReadX 13499 131072 65471 65471
ReadX 13499 196543 65 65
ReadX 13499 196608 65471 65471
ReadX 13499 262079 65 65
ReadX 13499 262144 65471 65471
ReadX 13499 327615 65 65
ReadX 13499 327680 65471 65471
ReadX 13499 393151 65 65
ReadX 13499 393216 65471 65471
ReadX 13499 458687 65 65
ReadX 13499 458752 65471 65471
ReadX 13499 524223 65 65
ReadX 13499 524288 65471 65471
ReadX 13499 589759 65 65
ReadX 13499 589824 65471 65471
ReadX 13499 655295 65 65
ReadX 13499 655360 65471 65471
ReadX 13499 720831 65 65
ReadX 13499 720896 65471 65471
ReadX 13499 786367 65 65
ReadX 13499 786432 65471 65471
ReadX 13499 851903 65 65
ReadX 13499 851968 65471 65471
ReadX 13499 917439 65 65
ReadX 13499 917504 65471 65471
ReadX 13499 982975 65 65
ReadX 13499 983040 65471 65471
ReadX 13499 1048511 65 65
ReadX 13499 1048576 65471 65471
ReadX 13499 1114047 65 65
ReadX 13499 1114112 65471 65471
ReadX 13499 1179583 65 65
ReadX 13499 1179648 65471 65471
ReadX 13499 1245119 65 65
ReadX 13499 1245184 65471 65471
ReadX 13499 1310655 65 65
ReadX 13499 1310720 65471 65471
ReadX 13499 1376191 65 65
ReadX 13499 1376256 65471 65471
ReadX 13499 1441727 65 65
ReadX 13499 1441792 65471 65471
ReadX 13499 1507263 65 65
ReadX 13499 1507328 65471 65471
ReadX 13499 1572799 65 65
ReadX 13499 1572864 65471 65471
ReadX 13499 1638335 65 65
ReadX 13499 1638400 65471 65471
ReadX 13499 1703871 65 65
ReadX 13499 1703936 65471 65471
ReadX 13499 1769407 65 65
ReadX 13499 1769472 65471 65471
ReadX 13499 1834943 65 65
ReadX 13499 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13500
FIND_FIRST \clients\client1\~dmtmp\*
Close 13500
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13501
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13502
QUERY_FILE_INFORMATION 13502
QUERY_FILE_INFORMATION 13502
QUERY_FILE_INFORMATION 13502
ReadX 13502 2156 24 24
ReadX 13502 2139 276 276
ReadX 13502 2136 14 14
ReadX 13502 2136 7 7
ReadX 13502 2138 12 12
ReadX 13502 2137 8 8
ReadX 13502 2135 15 15
ReadX 13502 0 16 16
ReadX 13502 16 2048 2048
ReadX 13502 2064 2048 2048
ReadX 13502 257 2048 2048
ReadX 13502 385 2048 2048
ReadX 13502 513 2048 2048
ReadX 13502 641 2048 2048
ReadX 13502 769 2048 2048
ReadX 13502 897 2048 2048
ReadX 13502 1025 2048 2048
ReadX 13502 1153 2048 2048
ReadX 13502 1281 2048 2048
ReadX 13502 1409 2048 2048
ReadX 13502 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13504
Close 13504
Close 13450
Close 13497
Close 13498
Close 13499
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13506
WriteX 13506 15 1 1
QUERY_FILE_INFORMATION 13506
WriteX 13506 0 10575 10575
Flush 13506
Close 13506
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13507
Close 13507
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13508
ReadX 13508 0 4096 4096
Close 13502
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13509
Close 13509
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13510
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13511
QUERY_FILE_INFORMATION 13511
ReadX 13511 0 512 512
ReadX 13511 512 512 512
ReadX 13511 1024 512 512
QUERY_FILE_INFORMATION 13511
QUERY_FILE_INFORMATION 13511
Close 13511
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13512
QUERY_FILE_INFORMATION 13512
ReadX 13512 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13513
QUERY_FILE_INFORMATION 13513
ReadX 13513 0 512 512
ReadX 13513 512 512 512
ReadX 13513 1024 512 512
ReadX 13513 288 20 20
ReadX 13513 308 2084 2084
ReadX 13513 388 2084 2084
ReadX 13513 388 2084 2084
ReadX 13501 2157 1386 1386
ReadX 13513 2472 399 399
ReadX 13513 3072 1536 1536
ReadX 13513 544 149 149
ReadX 13513 693 485 485
Close 13513
ReadX 13501 2157 4096 4096
ReadX 13501 6253 4096 4096
ReadX 13501 10349 4096 4096
ReadX 13501 14445 4096 4096
ReadX 13501 18541 4096 4096
ReadX 13501 22637 256 256
ReadX 13501 22893 4096 4096
ReadX 13501 26989 4096 4096
ReadX 13501 31085 4096 4096
ReadX 13501 35181 4096 4096
ReadX 13501 39277 4096 4096
ReadX 13501 43373 4096 4096
ReadX 13501 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13501 2157 1024 1024
ReadX 13501 1667 4688 4688
ReadX 13501 6355 3516 3516
ReadX 13501 9871 16384 16384
ReadX 13501 26255 3771 3771
ReadX 13501 30026 2048 2048
ReadX 13501 32074 1024 1024
ReadX 13501 33098 6652 6652
ReadX 13501 39750 16384 16384
ReadX 13501 56134 10496 10496
ReadX 13501 66630 1784 1784
ReadX 13501 68414 90 90
ReadX 13501 68504 273 273
ReadX 13501 68777 1600 1600
ReadX 13501 70377 640 640
ReadX 13501 71017 1280 1280
ReadX 13501 72297 8464 8464
ReadX 13501 80761 158 158
ReadX 13501 80919 912 912
ReadX 13501 81831 1980 1980
ReadX 13501 83811 2256 2256
ReadX 13501 86067 400 400
ReadX 13501 86467 252 252
ReadX 13501 86719 42 42
ReadX 13501 86761 725 725
ReadX 13501 2009 512 512
ReadX 13501 3895 9 9
ReadX 13501 3781 46 46
ReadX 13501 4059 92 92
ReadX 13501 3781 92 92
ReadX 13501 3986 184 184
ReadX 13501 3987 16384 16384
ReadX 13501 3902 16384 16384
ReadX 13501 3781 10240 10240
ReadX 13501 3821 16384 16384
ReadX 13501 3891 935 935
ReadX 13501 4060 10240 10240
ReadX 13501 4059 184 184
ReadX 13501 256 184 184
ReadX 13501 256 1026 1026
ReadX 13501 3901 326 326
ReadX 13501 3899 652 652
ReadX 13501 256 2 2
ReadX 13501 258 4948 4948
Close 13501
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13515
Close 13515
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13517
WriteX 13517 4055 1 1
QUERY_FILE_INFORMATION 13517
WriteX 13517 0 65471 65471
WriteX 13517 65471 65 65
WriteX 13517 65536 65471 65471
WriteX 13517 131007 65 65
WriteX 13517 131072 65471 65471
WriteX 13517 196543 65 65
WriteX 13517 196608 65471 65471
WriteX 13517 262079 65 65
WriteX 13517 262144 65471 65471
WriteX 13517 327615 65 65
WriteX 13517 327680 65471 65471
WriteX 13517 393151 65 65
WriteX 13517 393216 65471 65471
WriteX 13517 458687 65 65
WriteX 13517 458752 65471 65471
WriteX 13517 524223 65 65
WriteX 13517 524288 65471 65471
WriteX 13517 589759 65 65
WriteX 13517 589824 35257 35257
Close 13517
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13519
Close 13519
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13521
WriteX 13521 4055 1 1
QUERY_FILE_INFORMATION 13521
WriteX 13521 0 65471 65471
WriteX 13521 65471 65 65
WriteX 13521 65536 65471 65471
WriteX 13521 131007 65 65
WriteX 13521 131072 65471 65471
WriteX 13521 196543 65 65
WriteX 13521 196608 65471 65471
WriteX 13521 262079 65 65
WriteX 13521 262144 65471 65471
WriteX 13521 327615 65 65
WriteX 13521 327680 65471 65471
WriteX 13521 393151 65 65
WriteX 13521 393216 65471 65471
WriteX 13521 458687 65 65
WriteX 13521 458752 65471 65471
WriteX 13521 524223 65 65
WriteX 13521 524288 65471 65471
WriteX 13521 589759 65 65
WriteX 13521 589824 57598 57598
Close 13521
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13523
WriteX 13523 15 1 1
QUERY_FILE_INFORMATION 13523
WriteX 13523 0 12543 12543
Flush 13523
Close 13523
Close 13508
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13524
Close 13524
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13525
ReadX 13525 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13526
FIND_FIRST \clients\client1\~dmtmp\*
Close 13526
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13527
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13528
QUERY_FILE_INFORMATION 13528
QUERY_FILE_INFORMATION 13528
QUERY_FILE_INFORMATION 13528
ReadX 13528 1938 24 24
ReadX 13528 1920 276 276
ReadX 13528 1918 14 14
ReadX 13528 1918 7 7
ReadX 13528 1919 12 12
ReadX 13528 1919 8 8
ReadX 13528 1917 15 15
ReadX 13528 0 16 16
ReadX 13528 16 2048 2048
ReadX 13528 2064 2048 2048
ReadX 13528 257 2048 2048
ReadX 13528 385 2048 2048
ReadX 13528 513 2048 2048
ReadX 13528 641 2048 2048
ReadX 13528 769 2048 2048
ReadX 13528 897 2048 2048
ReadX 13528 1025 2048 2048
ReadX 13528 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13530
Close 13530
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13532
WriteX 13532 15 1 1
QUERY_FILE_INFORMATION 13532
WriteX 13532 0 11588 11588
Flush 13532
Close 13532
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13533
Close 13533
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13534
ReadX 13534 0 4096 4096
Close 13528
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13536
WriteX 13536 15 1 1
QUERY_FILE_INFORMATION 13536
WriteX 13536 0 11615 11615
Flush 13536
Close 13536
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13534
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13537
Close 13537
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13538
ReadX 13538 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13540
Close 13540
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13542
WriteX 13542 4088 1 1
QUERY_FILE_INFORMATION 13542
WriteX 13542 0 65471 65471
WriteX 13542 65471 65 65
WriteX 13542 65536 16050 16050
Close 13542
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13527 1939 64 64
ReadX 13527 128 248 248
ReadX 13527 128 568 568
ReadX 13527 3872 1536 1536
ReadX 13527 3456 2560 2560
ReadX 13527 3136 512 512
ReadX 13527 2880 4096 4096
ReadX 13527 3264 3072 3072
ReadX 13527 320 4096 4096
ReadX 13527 1024 4096 4096
ReadX 13527 3616 4096 4096
ReadX 13527 1939 64 64
ReadX 13527 128 248 248
ReadX 13527 128 608 608
ReadX 13527 2858 1024 1024
ReadX 13527 2810 4096 4096
ReadX 13527 2826 4096 4096
ReadX 13527 2580 2048 2048
ReadX 13527 2800 2560 2560
ReadX 13527 2100 4096 4096
ReadX 13527 2084 4096 4096
ReadX 13527 868 4096 4096
ReadX 13527 2324 4096 4096
ReadX 13527 884 4096 4096
ReadX 13527 2604 1024 1024
ReadX 13527 580 4096 4096
ReadX 13527 596 4096 4096
ReadX 13527 2752 4096 4096
ReadX 13527 2842 1024 1024
ReadX 13527 660 4096 4096
ReadX 13527 2720 4096 4096
ReadX 13527 2736 4096 4096
ReadX 13527 628 4096 4096
ReadX 13527 2704 4096 4096
ReadX 13527 1556 4096 4096
ReadX 13527 576 4096 4096
ReadX 13527 3168 1536 1536
ReadX 13527 832 4096 4096
ReadX 13527 1088 4096 4096
ReadX 13527 1344 4096 4096
ReadX 13527 1600 4096 4096
ReadX 13527 1856 4096 4096
ReadX 13527 2112 4096 4096
ReadX 13527 1892 4096 4096
ReadX 13527 820 4096 4096
ReadX 13527 788 4096 4096
ReadX 13527 1604 4096 4096
ReadX 13527 3648 4096 4096
ReadX 13527 2608 4096 4096
ReadX 13527 548 4096 4096
ReadX 13527 740 4096 4096
ReadX 13527 1344 4096 4096
ReadX 13527 3392 4096 4096
ReadX 13527 3904 4096 4096
ReadX 13527 644 4096 4096
ReadX 13527 676 4096 4096
ReadX 13527 2688 4096 4096
ReadX 13527 320 4096 4096
ReadX 13527 900 4096 4096
ReadX 13527 1908 4096 4096
ReadX 13527 852 4096 4096
ReadX 13527 724 4096 4096
ReadX 13527 2292 4096 4096
ReadX 13527 612 4096 4096
ReadX 13527 388 4096 4096
ReadX 13527 2368 4096 4096
ReadX 13527 2624 4096 4096
ReadX 13527 500 4096 4096
ReadX 13527 356 4096 4096
ReadX 13527 1024 4096 4096
ReadX 13527 576 4096 4096
ReadX 13527 340 4096 4096
ReadX 13527 420 4096 4096
ReadX 13527 1600 4096 4096
ReadX 13527 404 4096 4096
ReadX 13527 1428 4096 4096
ReadX 13527 2656 4096 4096
ReadX 13527 2624 4096 4096
ReadX 13527 452 4096 4096
ReadX 13527 692 4096 4096
ReadX 13527 564 4096 4096
ReadX 13527 372 4096 4096
ReadX 13527 468 4096 4096
ReadX 13527 484 4096 4096
ReadX 13527 1088 4096 4096
ReadX 13527 1924 4096 4096
ReadX 13527 2768 4096 4096
ReadX 13527 832 4096 4096
ReadX 13527 836 4096 4096
ReadX 13527 1856 4096 4096
ReadX 13527 2640 4096 4096
ReadX 13527 436 4096 4096
ReadX 13527 1828 4096 4096
ReadX 13527 804 4096 4096
ReadX 13527 1860 4096 4096
ReadX 13527 1812 4096 4096
ReadX 13527 756 4096 4096
ReadX 13527 1636 4096 4096
ReadX 13527 772 4096 4096
ReadX 13527 2036 4096 4096
ReadX 13527 1220 4096 4096
ReadX 13527 1652 4096 4096
ReadX 13527 2588 4096 4096
ReadX 13527 916 4096 4096
ReadX 13527 260 4096 4096
ReadX 13527 932 4096 4096
ReadX 13527 2624 4096 4096
ReadX 13527 308 4096 4096
ReadX 13527 292 4096 4096
ReadX 13527 1140 4096 4096
ReadX 13527 276 4096 4096
ReadX 13527 2020 4096 4096
ReadX 13527 2880 4096 4096
ReadX 13527 516 4096 4096
ReadX 13527 1844 4096 4096
ReadX 13527 1124 4096 4096
ReadX 13527 3136 4096 4096
ReadX 13527 324 4096 4096
ReadX 13527 1156 4096 4096
ReadX 13527 1172 4096 4096
ReadX 13527 2112 4096 4096
ReadX 13527 2368 4096 4096
ReadX 13527 964 4096 4096
ReadX 13527 980 4096 4096
ReadX 13527 1012 4096 4096
ReadX 13527 532 4096 4096
ReadX 13527 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13527 1620 4096 4096
ReadX 13527 1604 4096 4096
ReadX 13527 2116 4096 4096
ReadX 13527 2132 4096 4096
ReadX 13527 2148 4096 4096
ReadX 13527 2276 4096 4096
ReadX 13527 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13544
Close 13544
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13546
QUERY_FILE_INFORMATION 13510
Close 13510
WriteX 13546 4088 1 1
QUERY_FILE_INFORMATION 13546
QUERY_FILE_INFORMATION 13512
Close 13512
WriteX 13546 0 65471 65471
WriteX 13546 65471 65 65
WriteX 13546 65536 64850 64850
Close 13546
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13548
WriteX 13548 15 1 1
QUERY_FILE_INFORMATION 13548
ReadX 13527 2068 4096 4096
ReadX 13527 1588 4096 4096
ReadX 13527 1572 4096 4096
WriteX 13548 0 18630 18630
Flush 13548
Close 13548
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13538
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13549
Close 13549
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13550
ReadX 13550 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13527 612 4096 4096
ReadX 13527 564 4096 4096
ReadX 13527 1876 4096 4096
ReadX 13527 628 4096 4096
ReadX 13527 740 4096 4096
ReadX 13527 724 4096 4096
ReadX 13527 644 4096 4096
ReadX 13527 2324 4096 4096
ReadX 13527 660 4096 4096
ReadX 13527 852 4096 4096
ReadX 13527 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13527 2368 4096 4096
ReadX 13527 1024 4096 4096
ReadX 13527 320 4096 4096
ReadX 13527 580 4096 4096
ReadX 13527 3136 512 512
ReadX 13527 2880 4096 4096
Close 13527
Close 13550
Close 13525
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13551
ReadX 13551 61440 4096 4096
ReadX 13551 126976 4096 4096
WriteX 13551 0 65471 65471
WriteX 13551 65471 65 65
WriteX 13551 65536 65471 65471
WriteX 13551 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13552
ReadX 13552 61440 4096 4096
ReadX 13552 126976 4096 4096
ReadX 13552 192512 4096 4096
ReadX 13552 258048 4096 4096
WriteX 13552 0 65471 65471
WriteX 13552 65471 65 65
WriteX 13552 65536 65471 65471
WriteX 13552 131007 65 65
WriteX 13552 131072 65471 65471
WriteX 13552 196543 65 65
WriteX 13552 196608 65471 65471
WriteX 13552 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13553
ReadX 13553 61440 4096 4096
ReadX 13553 126976 4096 4096
ReadX 13553 192512 4096 4096
ReadX 13553 258048 4096 4096
ReadX 13553 323584 4096 4096
ReadX 13553 389120 4096 4096
ReadX 13553 454656 4096 4096
ReadX 13553 520192 4096 4096
WriteX 13553 0 65471 65471
WriteX 13553 65471 65 65
WriteX 13553 65536 65471 65471
WriteX 13553 131007 65 65
WriteX 13553 131072 65471 65471
WriteX 13553 196543 65 65
WriteX 13553 196608 65471 65471
WriteX 13553 262079 65 65
WriteX 13553 262144 65471 65471
WriteX 13553 327615 65 65
WriteX 13553 327680 65471 65471
WriteX 13553 393151 65 65
WriteX 13553 393216 65471 65471
WriteX 13553 458687 65 65
WriteX 13553 458752 65471 65471
WriteX 13553 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13554
Close 13554
Close 13551
Close 13552
Close 13553
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13555
Close 13555
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13558
Close 13558
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13560
Close 13560
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13561
Close 13561
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13564
Close 13564
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13566
Close 13566
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13567
Close 13567
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13570
Close 13570
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13574
Close 13574
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13578
Close 13578
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13582
Close 13582
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13586
Close 13586
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13590
Close 13590
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13594
Close 13594
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13598
Close 13598
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13600
Close 13600
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13602
Close 13602
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13604
WriteX 13604 4095 1 1
QUERY_FILE_INFORMATION 13604
QUERY_FS_INFORMATION 259
WriteX 13604 0 65471 65471
WriteX 13604 65471 65 65
WriteX 13604 65536 65471 65471
WriteX 13604 131007 65 65
WriteX 13604 131072 65471 65471
WriteX 13604 196543 65 65
WriteX 13604 196608 65471 65471
WriteX 13604 262079 65 65
WriteX 13604 262144 26634 26634
Close 13604
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13609
Close 13609
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13610
Close 13610
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13611
ReadX 13611 0 4096 4096
Close 13611
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13612
ReadX 13612 0 4096 4096
ReadX 13612 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13613
Close 13613
Close 13612
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13616
Close 13616
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13618
Close 13618
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13619
Close 13619
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13622
Close 13622
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13624
Close 13624
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13625
Close 13625
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13628
Close 13628
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13632
Close 13632
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13636
Close 13636
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13640
Close 13640
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13644
Close 13644
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13648
Close 13648
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13651
Close 13651
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13655
Close 13655
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13659
Close 13659
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13661
Close 13661
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13662
Close 13662
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13671
Close 13671
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13672
FIND_FIRST \clients\client1\~dmtmp\*
Close 13672
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13673
Close 13673
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13674
ReadX 13674 0 4096 4096
Close 13674
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13675
ReadX 13675 0 4096 4096
Close 13675
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13676
ReadX 13676 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13686
Close 13686
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13687
FIND_FIRST \clients\client1\~dmtmp\*
Close 13687
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13688
Close 13688
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13689
ReadX 13689 0 4096 4096
Close 13689
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13690
ReadX 13690 0 4096 4096
Close 13690
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13691
ReadX 13691 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13692
ReadX 13692 0 65471 65471
ReadX 13692 65471 65 65
ReadX 13692 65536 65471 65471
ReadX 13692 131007 65 65
ReadX 13692 131072 65471 65471
ReadX 13692 196543 65 65
ReadX 13692 196608 65471 65471
ReadX 13692 262079 65 65
ReadX 13692 262144 65471 65471
ReadX 13692 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13693
ReadX 13693 0 65471 65471
ReadX 13693 65471 65 65
ReadX 13693 65536 65471 65471
ReadX 13693 131007 65 65
ReadX 13693 131072 65471 65471
ReadX 13693 196543 65 65
ReadX 13693 196608 65471 65471
ReadX 13693 262079 65 65
ReadX 13693 262144 65471 65471
ReadX 13693 327615 65 65
ReadX 13693 327680 65471 65471
ReadX 13693 393151 65 65
ReadX 13693 393216 65471 65471
ReadX 13693 458687 65 65
ReadX 13693 458752 65471 65471
ReadX 13693 524223 65 65
ReadX 13693 524288 65471 65471
ReadX 13693 589759 65 65
ReadX 13693 589824 65471 65471
ReadX 13693 655295 65 65
ReadX 13693 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13694
ReadX 13694 0 65471 65471
ReadX 13694 65471 65 65
ReadX 13694 65536 65471 65471
ReadX 13694 131007 65 65
ReadX 13694 131072 65471 65471
ReadX 13694 196543 65 65
ReadX 13694 196608 65471 65471
ReadX 13694 262079 65 65
ReadX 13694 262144 65471 65471
ReadX 13694 327615 65 65
ReadX 13694 327680 65471 65471
ReadX 13694 393151 65 65
ReadX 13694 393216 65471 65471
ReadX 13694 458687 65 65
ReadX 13694 458752 65471 65471
ReadX 13694 524223 65 65
ReadX 13694 524288 65471 65471
ReadX 13694 589759 65 65
ReadX 13694 589824 65471 65471
ReadX 13694 655295 65 65
ReadX 13694 655360 65471 65471
ReadX 13694 720831 65 65
ReadX 13694 720896 65471 65471
ReadX 13694 786367 65 65
ReadX 13694 786432 65471 65471
ReadX 13694 851903 65 65
ReadX 13694 851968 65471 65471
ReadX 13694 917439 65 65
ReadX 13694 917504 65471 65471
ReadX 13694 982975 65 65
ReadX 13694 983040 65471 65471
ReadX 13694 1048511 65 65
ReadX 13694 1048576 65471 65471
ReadX 13694 1114047 65 65
ReadX 13694 1114112 65471 65471
ReadX 13694 1179583 65 65
ReadX 13694 1179648 65471 65471
ReadX 13694 1245119 65 65
ReadX 13694 1245184 65471 65471
ReadX 13694 1310655 65 65
ReadX 13694 1310720 65471 65471
ReadX 13694 1376191 65 65
ReadX 13694 1376256 65471 65471
ReadX 13694 1441727 65 65
ReadX 13694 1441792 65471 65471
ReadX 13694 1507263 65 65
ReadX 13694 1507328 65471 65471
ReadX 13694 1572799 65 65
ReadX 13694 1572864 65471 65471
ReadX 13694 1638335 65 65
ReadX 13694 1638400 65471 65471
ReadX 13694 1703871 65 65
ReadX 13694 1703936 65471 65471
ReadX 13694 1769407 65 65
ReadX 13694 1769472 65471 65471
ReadX 13694 1834943 65 65
ReadX 13694 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13695
ReadX 13695 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13695 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13695 8192 4096 4096
ReadX 13695 12288 4096 4096
ReadX 13695 16384 4096 4096
ReadX 13695 20480 4096 4096
ReadX 13695 24576 4096 4096
ReadX 13695 28672 4096 4096
ReadX 13695 32768 4096 4096
ReadX 13695 36864 4096 4096
ReadX 13695 40960 4096 4096
ReadX 13695 45056 4096 4096
ReadX 13695 49152 4096 4096
ReadX 13695 53248 4096 4096
ReadX 13695 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13695 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13696
Close 13696
Close 13676
Close 13691
Close 13692
Close 13693
Close 13694
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13697
WriteX 13697 1535 1 1
QUERY_FILE_INFORMATION 13697
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13695 0 4096 4096
ReadX 13695 4096 4096 4096
QUERY_FILE_INFORMATION 13697
WriteX 13697 0 57088 57088
WriteX 13697 0 4096 4096
Flush 13697
Close 13695
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13698
Close 13698
WriteX 13697 0 4096 4096
Close 13697
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13699
Close 13699
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13700
ReadX 13700 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13700 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13701
WriteX 13701 1535 1 1
QUERY_FILE_INFORMATION 13701
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13700 0 4096 4096
QUERY_FILE_INFORMATION 13701
WriteX 13701 0 51456 51456
WriteX 13701 0 4096 4096
Flush 13701
Close 13700
WriteX 13701 0 4096 4096
Close 13701
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13702
Close 13702
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13703
ReadX 13703 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13703 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13705
Close 13705
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13707
WriteX 13707 4045 1 1
QUERY_FILE_INFORMATION 13707
WriteX 13707 0 53077 53077
Close 13707
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13708
WriteX 13708 1535 1 1
QUERY_FILE_INFORMATION 13708
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13703 0 4096 4096
QUERY_FILE_INFORMATION 13708
WriteX 13708 0 65471 65471
WriteX 13708 65471 65 65
WriteX 13708 65536 1856 1856
WriteX 13708 0 4096 4096
Flush 13708
Close 13703
WriteX 13708 0 4096 4096
Close 13708
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13709
Close 13709
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13710
ReadX 13710 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13712
Close 13712
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13714
WriteX 13714 4076 1 1
QUERY_FILE_INFORMATION 13714
WriteX 13714 0 7983 7983
Close 13714
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13716
Close 13716
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13718
WriteX 13718 4095 1 1
QUERY_FILE_INFORMATION 13718
WriteX 13718 0 65471 65471
WriteX 13718 65471 65 65
WriteX 13718 65536 65471 65471
WriteX 13718 131007 65 65
WriteX 13718 131072 65471 65471
WriteX 13718 196543 65 65
WriteX 13718 196608 65471 65471
WriteX 13718 262079 65 65
WriteX 13718 262144 65471 65471
WriteX 13718 327615 65 65
WriteX 13718 327680 65471 65471
WriteX 13718 393151 65 65
WriteX 13718 393216 65471 65471
WriteX 13718 458687 65 65
WriteX 13718 458752 46731 46731
Close 13718
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13719
WriteX 13719 1535 1 1
QUERY_FILE_INFORMATION 13719
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13710 0 4096 4096
ReadX 13710 4096 4096 4096
QUERY_FILE_INFORMATION 13719
WriteX 13719 0 65471 65471
WriteX 13719 65471 65 65
WriteX 13719 65536 22848 22848
WriteX 13719 0 4096 4096
Flush 13719
Close 13710
WriteX 13719 0 4096 4096
Close 13719
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13720
Close 13720
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13721
ReadX 13721 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13721 4096 4096 4096
Close 13721
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13722
ReadX 13722 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13722 0 8192 8192
ReadX 13722 8192 4096 4096
ReadX 13722 12288 4096 4096
ReadX 13722 16384 4096 4096
ReadX 13722 20480 4096 4096
ReadX 13722 24576 4096 4096
ReadX 13722 28672 4096 4096
ReadX 13722 32768 4096 4096
ReadX 13722 36864 4096 4096
ReadX 13722 40960 4096 4096
ReadX 13722 45056 4096 4096
ReadX 13722 49152 4096 4096
ReadX 13722 53248 4096 4096
ReadX 13722 57344 4096 4096
ReadX 13722 61440 4096 4096
ReadX 13722 65536 4096 4096
ReadX 13722 69632 4096 4096
ReadX 13722 73728 4096 4096
ReadX 13722 77824 4096 4096
ReadX 13722 81920 4096 4096
ReadX 13722 86016 4096 4096
ReadX 13722 90112 4096 4096
ReadX 13722 94208 4096 4096
ReadX 13722 98304 4096 4096
ReadX 13722 102400 4096 4096
ReadX 13722 106496 4096 4096
ReadX 13722 110592 4096 4096
ReadX 13722 114688 4096 4096
ReadX 13722 118784 4096 4096
ReadX 13722 122880 4096 4096
ReadX 13722 126976 4096 4096
ReadX 13722 131072 4096 4096
ReadX 13722 135168 4096 4096
ReadX 13722 139264 4096 4096
ReadX 13722 143360 4096 4096
ReadX 13722 147456 4096 4096
ReadX 13722 151552 4096 4096
ReadX 13722 155648 4096 4096
ReadX 13722 159744 4096 4096
ReadX 13722 163840 4096 4096
ReadX 13722 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13722 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13723
Close 13723
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13724
WriteX 13724 2047 1 1
QUERY_FILE_INFORMATION 13724
Close 13722
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13725
Close 13725
WriteX 13724 0 42388 42388
Close 13724
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13726
Close 13726
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13727
ReadX 13727 0 4096 4096
ReadX 13727 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13728
WriteX 13728 2047 1 1
QUERY_FILE_INFORMATION 13728
Close 13727
WriteX 13728 0 42652 42652
Close 13728
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13729
Close 13729
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13730
ReadX 13730 0 4096 4096
ReadX 13730 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13732
Close 13732
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13734
WriteX 13734 4080 1 1
QUERY_FILE_INFORMATION 13734
WriteX 13734 0 65471 65471
WriteX 13734 65471 65 65
WriteX 13734 65536 49 49
Close 13734
Close 13730
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13735
ReadX 13735 61440 4096 4096
ReadX 13735 126976 4096 4096
WriteX 13735 0 65471 65471
WriteX 13735 65471 65 65
WriteX 13735 65536 65471 65471
WriteX 13735 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13736
ReadX 13736 61440 4096 4096
ReadX 13736 126976 4096 4096
ReadX 13736 192512 4096 4096
ReadX 13736 258048 4096 4096
WriteX 13736 0 65471 65471
WriteX 13736 65471 65 65
WriteX 13736 65536 65471 65471
WriteX 13736 131007 65 65
WriteX 13736 131072 65471 65471
WriteX 13736 196543 65 65
WriteX 13736 196608 65471 65471
WriteX 13736 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13737
ReadX 13737 61440 4096 4096
ReadX 13737 126976 4096 4096
ReadX 13737 192512 4096 4096
ReadX 13737 258048 4096 4096
ReadX 13737 323584 4096 4096
ReadX 13737 389120 4096 4096
ReadX 13737 454656 4096 4096
ReadX 13737 520192 4096 4096
WriteX 13737 0 65471 65471
WriteX 13737 65471 65 65
WriteX 13737 65536 65471 65471
WriteX 13737 131007 65 65
WriteX 13737 131072 65471 65471
WriteX 13737 196543 65 65
WriteX 13737 196608 65471 65471
WriteX 13737 262079 65 65
WriteX 13737 262144 65471 65471
WriteX 13737 327615 65 65
WriteX 13737 327680 65471 65471
WriteX 13737 393151 65 65
WriteX 13737 393216 65471 65471
WriteX 13737 458687 65 65
WriteX 13737 458752 65471 65471
WriteX 13737 524223 65 65
Close 13735
Close 13736
Close 13737
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13738
FIND_FIRST \clients\client1\~dmtmp\*
Close 13738
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13739
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13739 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13740
ReadX 13740 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13741
ReadX 13741 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13742
ReadX 13742 0 4096 4096
ReadX 13739 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13739
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13743
ReadX 13743 0 4096 4096
ReadX 13743 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13744
FIND_FIRST \clients\client1\~dmtmp\*
Close 13744
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13745
QUERY_FILE_INFORMATION 13745
WriteX 13745 2047 1 1
QUERY_FILE_INFORMATION 13745
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13746
Close 13746
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13747
WriteX 13747 52 1 1
QUERY_FILE_INFORMATION 13747
WriteX 13747 0 491 491
Close 13747
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13748
ReadX 13748 0 491 491
WriteX 13745 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13743
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13749
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13749 0 4096 4096
ReadX 13749 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13751
Close 13751
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13752
WriteX 13752 52 1 1
QUERY_FILE_INFORMATION 13752
WriteX 13752 0 543 543
Close 13752
Close 13749
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13753
ReadX 13753 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13754
ReadX 13754 0 543 543
ReadX 13753 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13753
Close 13748
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13754
Close 13740
Close 13741
Close 13742
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13745
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13755
FIND_FIRST \clients\client1\~dmtmp\*
Close 13755
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13756
ReadX 13756 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13757
ReadX 13757 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13758
ReadX 13758 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13759
ReadX 13759 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13760
ReadX 13760 0 543 543
ReadX 13756 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13764
FIND_FIRST \clients\client1\~dmtmp\*
Close 13764
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13765
QUERY_FILE_INFORMATION 13765
WriteX 13765 2047 1 1
QUERY_FILE_INFORMATION 13765
WriteX 13765 0 2048 2048
Close 13765
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13766
ReadX 13766 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13766
Close 13756
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13767
ReadX 13767 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13767 4095 1 1
QUERY_FILE_INFORMATION 13767
ReadX 13767 0 4096 4096
WriteX 13767 0 4096 4096
Flush 13767
WriteX 13767 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13768
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13768 0 4096 4096
ReadX 13768 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13772
FIND_FIRST \clients\client1\~dmtmp\*
Close 13772
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13773
WriteX 13773 2047 1 1
QUERY_FILE_INFORMATION 13773
WriteX 13773 0 2048 2048
Close 13773
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13774
ReadX 13774 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13778
Close 13778
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13779
WriteX 13779 2047 1 1
QUERY_FILE_INFORMATION 13779
WriteX 13779 0 2048 2048
Close 13779
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13780
ReadX 13780 0 2048 2048
ReadX 13768 4096 16384 16384
Close 13780
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13781
ReadX 13781 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13781
Close 13760
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13774 4095 1 1
QUERY_FILE_INFORMATION 13774
ReadX 13774 0 4096 4096
WriteX 13774 0 4096 4096
Close 13774
WriteX 13768 0 8192 8192
Close 13768
WriteX 13757 0 4096 4096
WriteX 13758 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13783
ReadX 13783 0 4096 4096
ReadX 13783 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13783
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13784
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13784 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13785
ReadX 13785 0 543 543
ReadX 13784 0 4096 4096
Close 13784
Close 13767
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13786
QUERY_FILE_INFORMATION 13786
Close 13786
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13785
Close 13757
Close 13758
Close 13759
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13787
FIND_FIRST \clients\client1\~dmtmp\*
Close 13787
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13788
ReadX 13788 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13789
ReadX 13789 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13790
ReadX 13790 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13791
ReadX 13791 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13792
ReadX 13792 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13793
ReadX 13793 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13794
ReadX 13794 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13795
ReadX 13795 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13796
ReadX 13796 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13797
ReadX 13797 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13798
ReadX 13798 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13799
ReadX 13799 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13800
ReadX 13800 0 4096 4096
ReadX 13788 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13804
FIND_FIRST \clients\client1\~dmtmp\*
Close 13804
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13805
QUERY_FILE_INFORMATION 13805
WriteX 13805 2047 1 1
QUERY_FILE_INFORMATION 13805
WriteX 13805 0 2048 2048
Close 13805
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13806
ReadX 13806 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13806
Close 13796
Close 13788
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13807
ReadX 13807 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13808
FIND_FIRST \clients\client1\~dmtmp\*
Close 13808
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13809
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13809 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13810
ReadX 13810 0 4096 4096
ReadX 13809 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13814
FIND_FIRST \clients\client1\~dmtmp\*
Close 13814
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13815
QUERY_FILE_INFORMATION 13815
WriteX 13815 2047 1 1
QUERY_FILE_INFORMATION 13815
WriteX 13815 0 2048 2048
Close 13815
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13816
ReadX 13816 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13816
Close 13809
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13817
ReadX 13817 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13807 4095 1 1
QUERY_FILE_INFORMATION 13807
ReadX 13807 0 4096 4096
WriteX 13807 0 4096 4096
Flush 13807
WriteX 13817 4095 1 1
QUERY_FILE_INFORMATION 13817
ReadX 13817 0 4096 4096
WriteX 13817 0 4096 4096
WriteX 13807 0 4096 4096
Flush 13817
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 13817 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13818
ReadX 13818 0 4096 4096
ReadX 13810 0 4096 4096
ReadX 13818 0 4096 4096
ReadX 13818 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13819
FIND_FIRST \clients\client1\~dmtmp\*
Close 13819
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13820
WriteX 13820 4095 1 1
QUERY_FILE_INFORMATION 13820
WriteX 13820 0 4096 4096
Close 13820
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13821
ReadX 13821 0 4096 4096
Close 13818
Close 13810
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13822
Close 13822
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13823
WriteX 13823 4095 1 1
QUERY_FILE_INFORMATION 13823
WriteX 13823 0 4096 4096
Close 13823
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13824
ReadX 13824 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 13824 0 4096 4096
Close 13821
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13800
Close 13794
Close 13797
Close 13798
Close 13799
Close 13795
Close 13789
Close 13792
Close 13793
Close 13790
Close 13791
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13824
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13826
Close 13826
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13827
ReadX 13827 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13828
Close 13828
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13829
WriteX 13829 2047 1 1
QUERY_FILE_INFORMATION 13829
WriteX 13829 0 2048 2048
Close 13829
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13830
ReadX 13830 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13830
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13831
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13831 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13832
ReadX 13832 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13833
ReadX 13833 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13834
ReadX 13834 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13835
ReadX 13835 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13836
ReadX 13836 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13837
ReadX 13837 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13838
ReadX 13838 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13839
ReadX 13839 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13840
ReadX 13840 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13841
ReadX 13841 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13842
ReadX 13842 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13843
ReadX 13843 0 4096 4096
ReadX 13831 0 4096 4096
ReadX 13838 0 4096 4096
Close 13838
Close 13831
Close 13807
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13844
QUERY_FILE_INFORMATION 13844
Close 13844
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13827
Close 13842
Close 13837
Close 13839
Close 13840
Close 13841
Close 13843
Close 13832
Close 13835
Close 13836
Close 13833
Close 13834
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13817
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13845
QUERY_FILE_INFORMATION 13845
Close 13845
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13846
FIND_FIRST \clients\client1\~dmtmp\*
Close 13846
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13847
ReadX 13847 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13848
ReadX 13848 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13849
ReadX 13849 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13850
ReadX 13850 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13851
ReadX 13851 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13852
ReadX 13852 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13853
ReadX 13853 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13854
ReadX 13854 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13855
ReadX 13855 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13856
ReadX 13856 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13857
ReadX 13857 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13858
ReadX 13858 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13859
ReadX 13859 0 4096 4096
ReadX 13847 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13863
FIND_FIRST \clients\client1\~dmtmp\*
Close 13863
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13864
QUERY_FILE_INFORMATION 13864
WriteX 13864 2047 1 1
QUERY_FILE_INFORMATION 13864
WriteX 13864 0 2048 2048
Close 13864
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13865
ReadX 13865 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13865
Close 13847
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13866
ReadX 13866 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13867
FIND_FIRST \clients\client1\~dmtmp\*
Close 13867
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13868
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13868 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13869
ReadX 13869 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13870
ReadX 13870 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13871
ReadX 13871 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13872
ReadX 13872 0 543 543
ReadX 13868 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13876
FIND_FIRST \clients\client1\~dmtmp\*
Close 13876
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13877
QUERY_FILE_INFORMATION 13877
WriteX 13877 2047 1 1
QUERY_FILE_INFORMATION 13877
WriteX 13877 0 2048 2048
Close 13877
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13878
ReadX 13878 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13878
Close 13868
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13879
ReadX 13879 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 13852
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13880
FIND_FIRST \clients\client1\~dmtmp\*
Close 13880
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13881
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13881 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13882
ReadX 13882 0 4096 4096
ReadX 13881 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13886
FIND_FIRST \clients\client1\~dmtmp\*
Close 13886
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13887
QUERY_FILE_INFORMATION 13887
WriteX 13887 2047 1 1
QUERY_FILE_INFORMATION 13887
WriteX 13887 0 2048 2048
Close 13887
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13888
ReadX 13888 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13888
Close 13882
Close 13881
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13889
ReadX 13889 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13866 4095 1 1
QUERY_FILE_INFORMATION 13866
ReadX 13866 0 4096 4096
WriteX 13866 0 4096 4096
Flush 13866
WriteX 13879 4095 1 1
QUERY_FILE_INFORMATION 13879
ReadX 13879 0 4096 4096
WriteX 13879 0 4096 4096
Flush 13879
WriteX 13889 4095 1 1
QUERY_FILE_INFORMATION 13889
ReadX 13889 0 4096 4096
WriteX 13889 0 4096 4096
Flush 13889
WriteX 13866 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 13879 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 13889 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13890
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13890 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13891
ReadX 13891 0 4096 4096
ReadX 13890 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13892
ReadX 13892 0 4096 4096
ReadX 13892 0 4096 4096
ReadX 13892 4096 16384 16384
ReadX 13890 4096 16384 16384
ReadX 13890 0 4096 4096
ReadX 13891 0 4096 4096
ReadX 13891 4096 4096 4096
Close 13892
Close 13891
Close 13890
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13893
FIND_FIRST \clients\client1\~dmtmp\*
Close 13893
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13894
ReadX 13894 0 2048 2048
WriteX 13894 18431 1 1
QUERY_FILE_INFORMATION 13894
WriteX 13894 0 19584 19584
Close 13894
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13895
ReadX 13895 0 4096 4096
ReadX 13895 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13895
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13896
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13896 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13897
ReadX 13897 0 4096 4096
ReadX 13896 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13898
ReadX 13898 0 4096 4096
ReadX 13898 0 4096 4096
Close 13898
Close 13897
Close 13896
Close 13866
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13899
QUERY_FILE_INFORMATION 13899
Close 13899
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13872
Close 13859
Close 13851
Close 13869
Close 13870
Close 13871
Close 13858
Close 13853
Close 13856
Close 13857
Close 13854
Close 13855
Close 13848
Close 13849
Close 13850
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13879
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13900
QUERY_FILE_INFORMATION 13900
Close 13900
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13889
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13901
QUERY_FILE_INFORMATION 13901
Close 13901
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13902
FIND_FIRST \clients\client1\~dmtmp\*
Close 13902
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13903
ReadX 13903 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13904
ReadX 13904 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13905
ReadX 13905 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13906
ReadX 13906 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13907
ReadX 13907 0 543 543
ReadX 13903 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13903 4096 16384 16384
WriteX 13903 0 4096 4096
Close 13903
WriteX 13904 0 4096 4096
WriteX 13905 0 4096 4096
WriteX 13906 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13908
FIND_FIRST \clients\client1\~dmtmp\*
Close 13908
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13909
ReadX 13909 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13910
ReadX 13910 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13911
ReadX 13911 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13912
ReadX 13912 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13913
ReadX 13913 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13914
ReadX 13914 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13915
ReadX 13915 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13916
ReadX 13916 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13917
ReadX 13917 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13918
ReadX 13918 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13919
ReadX 13919 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13920
ReadX 13920 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13921
ReadX 13921 0 4096 4096
ReadX 13909 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13922
ReadX 13922 0 8192 8192
ReadX 13909 4096 16384 16384
Close 13916
Close 13909
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13923
FIND_FIRST \clients\client1\~dmtmp\*
Close 13923
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13924
ReadX 13924 0 4096 4096
ReadX 13924 4096 4096 4096
ReadX 13924 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13925
ReadX 13925 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13926
ReadX 13926 0 4096 4096
ReadX 13925 0 4096 4096
ReadX 13925 0 4096 4096
ReadX 13925 4096 16384 16384
Close 13926
WriteX 13925 0 4096 4096
Close 13925
WriteX 13910 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13927
FIND_FIRST \clients\client1\~dmtmp\*
Close 13927
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13928
ReadX 13928 0 4096 4096
ReadX 13928 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13929
ReadX 13929 0 4096 4096
ReadX 13929 0 4096 4096
WriteX 13929 0 4096 4096
Close 13929
WriteX 13904 0 4096 4096
WriteX 13905 0 4096 4096
WriteX 13906 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13930
ReadX 13930 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13931
ReadX 13931 0 4096 4096
ReadX 13930 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13935
FIND_FIRST \clients\client1\~dmtmp\*
Close 13935
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 2047 1 1
QUERY_FILE_INFORMATION 13936
WriteX 13936 0 2048 2048
Close 13936
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13937
ReadX 13937 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13937 4095 1 1
QUERY_FILE_INFORMATION 13937
ReadX 13937 0 4096 4096
WriteX 13937 0 4096 4096
Close 13937
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13938
ReadX 13938 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13938 0 4096 4096
Close 13931
Close 13930
WriteX 13938 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13939
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13939 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13940
ReadX 13940 0 4096 4096
ReadX 13939 0 4096 4096
ReadX 13939 4096 16384 16384
Close 13940
Close 13939
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13941
FIND_FIRST \clients\client1\~dmtmp\*
Close 13941
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13942
ReadX 13942 0 4096 4096
ReadX 13942 4096 4096 4096
WriteX 13942 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13942 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13942
ReadX 13938 0 4096 4096
WriteX 13938 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13943
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13943 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13944
ReadX 13944 0 4096 4096
ReadX 13943 0 4096 4096
ReadX 13943 4096 16384 16384
Close 13944
Close 13943
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13945
FIND_FIRST \clients\client1\~dmtmp\*
Close 13945
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13946
ReadX 13946 0 4096 4096
ReadX 13946 4096 4096 4096
WriteX 13946 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13946 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13946
Close 13938
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13947
QUERY_FILE_INFORMATION 13947
Close 13947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13922
Close 13924
Close 13928
Close 13907
Close 13904
Close 13905
Close 13906
Close 13915
Close 13920
Close 13917
Close 13918
Close 13919
Close 13921
Close 13910
Close 13913
Close 13914
Close 13911
Close 13912
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13948
FIND_FIRST \clients\client1\~dmtmp\*
Close 13948
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13949
ReadX 13949 0 4096 4096
ReadX 13949 4096 4096 4096
ReadX 13949 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13950
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13950 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13951
ReadX 13951 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13952
ReadX 13952 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13953
ReadX 13953 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13954
ReadX 13954 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13955
ReadX 13955 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13956
ReadX 13956 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13957
ReadX 13957 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13958
ReadX 13958 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13959
ReadX 13959 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13960
ReadX 13960 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13961
ReadX 13961 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13962
ReadX 13962 0 4096 4096
ReadX 13950 0 4096 4096
ReadX 13950 0 4096 4096
ReadX 13950 4096 16384 16384
Close 13957
Close 13950
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13963
ReadX 13963 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13964
ReadX 13964 0 4096 4096
ReadX 13963 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13968
FIND_FIRST \clients\client1\~dmtmp\*
Close 13968
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13969
QUERY_FILE_INFORMATION 13969
WriteX 13969 2047 1 1
QUERY_FILE_INFORMATION 13969
WriteX 13969 0 2048 2048
Close 13969
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13970
ReadX 13970 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13970 4095 1 1
QUERY_FILE_INFORMATION 13970
ReadX 13970 0 4096 4096
WriteX 13970 0 4096 4096
Close 13970
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13971
ReadX 13971 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13971 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13975
Close 13975
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13976
QUERY_FILE_INFORMATION 13976
WriteX 13976 2047 1 1
QUERY_FILE_INFORMATION 13976
WriteX 13976 0 2048 2048
Close 13976
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13977
ReadX 13977 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13977 4095 1 1
QUERY_FILE_INFORMATION 13977
ReadX 13977 0 4096 4096
WriteX 13977 0 4096 4096
Close 13977
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13978
ReadX 13978 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13978 0 4096 4096
Close 13963
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13979
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13979 0 4096 4096
ReadX 13979 0 4096 4096
ReadX 13979 4096 16384 16384
Close 13979
Close 13971
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13980
QUERY_FILE_INFORMATION 13980
Close 13980
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13949
Close 13961
Close 13956
Close 13962
Close 13964
Close 13951
Close 13954
Close 13955
Close 13952
Close 13953
Close 13958
Close 13959
Close 13960
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13978
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13981
QUERY_FILE_INFORMATION 13981
Close 13981
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13982
ReadX 13982 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13983
Close 13983
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13984
WriteX 13984 63 1 1
QUERY_FILE_INFORMATION 13984
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13982 0 4096 4096
ReadX 13982 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13982 0 8192 8192
Flush 13982
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13982 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13982 0 8192 8192
Flush 13982
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13982 0 8192 8192
Flush 13982
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13982 0 8192 8192
Flush 13982
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13986
Close 13986
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13988
WriteX 13988 4065 1 1
QUERY_FILE_INFORMATION 13988
WriteX 13988 0 62591 62591
Close 13988
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13990
Close 13990
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13992
WriteX 13992 4094 1 1
QUERY_FILE_INFORMATION 13992
WriteX 13992 0 10845 10845
Close 13992
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13994
Close 13994
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13996
WriteX 13996 4081 1 1
QUERY_FILE_INFORMATION 13996
WriteX 13996 0 30118 30118
Close 13996
WriteX 13982 0 4096 4096
Close 13982
WriteX 13984 0 64 64
Close 13984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13997
ReadX 13997 61440 4096 4096
ReadX 13997 126976 4096 4096
WriteX 13997 0 65471 65471
WriteX 13997 65471 65 65
WriteX 13997 65536 65471 65471
WriteX 13997 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13998
ReadX 13998 61440 4096 4096
ReadX 13998 126976 4096 4096
ReadX 13998 192512 4096 4096
ReadX 13998 258048 4096 4096
WriteX 13998 0 65471 65471
WriteX 13998 65471 65 65
WriteX 13998 65536 65471 65471
WriteX 13998 131007 65 65
WriteX 13998 131072 65471 65471
WriteX 13998 196543 65 65
WriteX 13998 196608 65471 65471
WriteX 13998 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13999
ReadX 13999 61440 4096 4096
ReadX 13999 126976 4096 4096
ReadX 13999 192512 4096 4096
ReadX 13999 258048 4096 4096
ReadX 13999 323584 4096 4096
ReadX 13999 389120 4096 4096
ReadX 13999 454656 4096 4096
ReadX 13999 520192 4096 4096
WriteX 13999 0 65471 65471
WriteX 13999 65471 65 65
WriteX 13999 65536 65471 65471
WriteX 13999 131007 65 65
WriteX 13999 131072 65471 65471
WriteX 13999 196543 65 65
WriteX 13999 196608 65471 65471
WriteX 13999 262079 65 65
WriteX 13999 262144 65471 65471
WriteX 13999 327615 65 65
WriteX 13999 327680 65471 65471
WriteX 13999 393151 65 65
WriteX 13999 393216 65471 65471
WriteX 13999 458687 65 65
WriteX 13999 458752 65471 65471
WriteX 13999 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14000
Close 14000
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13997
Close 13998
Close 13999
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 14001
ReadX 14001 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 14002
ReadX 14002 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 14003
ReadX 14003 0 4096 4096
ReadX 14003 4096 4096 4096
ReadX 14003 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14004
Close 14004
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14001
Close 14002
Close 14003
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14005
Close 14005
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14006
ReadX 14006 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 14007
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 14007
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 14008
Close 14008
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 14009
ReadX 14009 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14010
Close 14010
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14006
Close 14009
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14011
Close 14011
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14012
ReadX 14012 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 14013
ReadX 14013 0 8192 8192
ReadX 14013 8192 8192 8192
ReadX 14013 16384 8192 8192
ReadX 14013 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14015
Close 14015
Close 14012
Close 14013
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14017
WriteX 14017 8191 1 1
QUERY_FILE_INFORMATION 14017
WriteX 14017 0 10438 10438
Close 14017
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14018
Close 14018
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14019
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14020
Close 14020
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14021
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14022
Close 14022
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14023
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14024
FIND_FIRST \clients\client1\~dmtmp\*
Close 14024
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14025
Close 14025
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14026
ReadX 14026 0 4096 4096
Close 14026
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14027
ReadX 14027 0 8192 8192
Close 14027
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14028
ReadX 14028 0 8192 8192
ReadX 14028 8192 4096 4096
ReadX 14028 12288 8192 8192
ReadX 14028 20480 8192 8192
ReadX 14028 28672 8192 8192
ReadX 14028 36864 8192 8192
ReadX 14028 45056 8192 8192
ReadX 14028 53248 8192 8192
ReadX 14028 61440 8192 8192
ReadX 14028 69632 8192 8192
ReadX 14028 77824 8192 8192
ReadX 14028 86016 8192 8192
ReadX 14028 94208 8192 8192
ReadX 14028 102400 8192 8192
ReadX 14028 110592 8192 8192
ReadX 14028 118784 8192 8192
ReadX 14028 126976 8192 8192
ReadX 14028 135168 8192 8192
ReadX 14028 143360 8192 8192
ReadX 14028 151552 8192 8192
ReadX 14028 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 14029
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14029
Close 14028
Close 14019
Close 14021
Close 14023
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 14030
Close 14030
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14032
WriteX 14032 8191 1 1
QUERY_FILE_INFORMATION 14032
WriteX 14032 0 28489 28489
Close 14032
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14033
Close 14033
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14034
FIND_FIRST \clients\client1\~dmtmp\*
Close 14034
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14035
Close 14035
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14036
ReadX 14036 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14037
Close 14037
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14036
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14038
Close 14038
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14039
ReadX 14039 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14040
ReadX 14040 0 8192 8192
ReadX 14040 8192 8192 8192
ReadX 14040 16384 8192 8192
ReadX 14040 24576 8192 8192
ReadX 14040 32768 16384 16384
ReadX 14040 49152 8192 8192
ReadX 14040 57344 8192 8192
ReadX 14040 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14042
Close 14042
Close 14039
Close 14040
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14044
WriteX 14044 8191 1 1
QUERY_FILE_INFORMATION 14044
WriteX 14044 0 29253 29253
Close 14044
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14045
Close 14045
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14046
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 14047
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14047
Close 14046
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 14048
Close 14048
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14050
WriteX 14050 8191 1 1
QUERY_FILE_INFORMATION 14050
WriteX 14050 0 30183 30183
Close 14050
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14051
Close 14051
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 14052
WriteX 14052 0 510 510
WriteX 14052 510 512 512
WriteX 14052 1022 510 510
WriteX 14052 1532 510 510
WriteX 14052 2042 168 168
Close 14052
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14053
Close 14053
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 14054
ReadX 14054 0 4096 4096
WriteX 14054 0 4096 4096
Close 14054
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14055
ReadX 14055 0 65471 65471
ReadX 14055 65471 65 65
ReadX 14055 65536 65471 65471
ReadX 14055 131007 65 65
ReadX 14055 131072 65471 65471
ReadX 14055 196543 65 65
ReadX 14055 196608 65471 65471
ReadX 14055 262079 65 65
ReadX 14055 262144 65471 65471
ReadX 14055 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14056
ReadX 14056 0 65471 65471
ReadX 14056 65471 65 65
ReadX 14056 65536 65471 65471
ReadX 14056 131007 65 65
ReadX 14056 131072 65471 65471
ReadX 14056 196543 65 65
ReadX 14056 196608 65471 65471
ReadX 14056 262079 65 65
ReadX 14056 262144 65471 65471
ReadX 14056 327615 65 65
ReadX 14056 327680 65471 65471
ReadX 14056 393151 65 65
ReadX 14056 393216 65471 65471
ReadX 14056 458687 65 65
ReadX 14056 458752 65471 65471
ReadX 14056 524223 65 65
ReadX 14056 524288 65471 65471
ReadX 14056 589759 65 65
ReadX 14056 589824 65471 65471
ReadX 14056 655295 65 65
ReadX 14056 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14057
ReadX 14057 0 65471 65471
ReadX 14057 65471 65 65
ReadX 14057 65536 65471 65471
ReadX 14057 131007 65 65
ReadX 14057 131072 65471 65471
ReadX 14057 196543 65 65
ReadX 14057 196608 65471 65471
ReadX 14057 262079 65 65
ReadX 14057 262144 65471 65471
ReadX 14057 327615 65 65
ReadX 14057 327680 65471 65471
ReadX 14057 393151 65 65
ReadX 14057 393216 65471 65471
ReadX 14057 458687 65 65
ReadX 14057 458752 65471 65471
ReadX 14057 524223 65 65
ReadX 14057 524288 65471 65471
ReadX 14057 589759 65 65
ReadX 14057 589824 65471 65471
ReadX 14057 655295 65 65
ReadX 14057 655360 65471 65471
ReadX 14057 720831 65 65
ReadX 14057 720896 65471 65471
ReadX 14057 786367 65 65
ReadX 14057 786432 65471 65471
ReadX 14057 851903 65 65
ReadX 14057 851968 65471 65471
ReadX 14057 917439 65 65
ReadX 14057 917504 65471 65471
ReadX 14057 982975 65 65
ReadX 14057 983040 65471 65471
ReadX 14057 1048511 65 65
ReadX 14057 1048576 65471 65471
ReadX 14057 1114047 65 65
ReadX 14057 1114112 65471 65471
ReadX 14057 1179583 65 65
ReadX 14057 1179648 65471 65471
ReadX 14057 1245119 65 65
ReadX 14057 1245184 65471 65471
ReadX 14057 1310655 65 65
ReadX 14057 1310720 65471 65471
ReadX 14057 1376191 65 65
ReadX 14057 1376256 65471 65471
ReadX 14057 1441727 65 65
ReadX 14057 1441792 65471 65471
ReadX 14057 1507263 65 65
ReadX 14057 1507328 65471 65471
ReadX 14057 1572799 65 65
ReadX 14057 1572864 65471 65471
ReadX 14057 1638335 65 65
ReadX 14057 1638400 65471 65471
ReadX 14057 1703871 65 65
ReadX 14057 1703936 65471 65471
ReadX 14057 1769407 65 65
ReadX 14057 1769472 65471 65471
ReadX 14057 1834943 65 65
ReadX 14057 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 14058
ReadX 14058 0 4096 4096
ReadX 14058 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 14059
WriteX 14059 52 1 1
QUERY_FILE_INFORMATION 14059
WriteX 14059 0 53 53
Close 14059
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 14060
Close 14060
Close 14055
Close 14056
Close 14057
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 14058 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 14061
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 14058 0 4096 4096
ReadX 14058 4096 4096 4096
ReadX 14058 8192 4096 4096
ReadX 14058 12288 4096 4096
WriteX 14061 15359 1 1
QUERY_FILE_INFORMATION 14061
ReadX 14058 16384 4096 4096
ReadX 14058 20480 4096 4096
WriteX 14061 0 15360 15360
Close 14061
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 14062
ReadX 14062 0 4096 4096
WriteX 14062 0 4096 4096
Close 14062
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 14063
Close 14063
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 14064
ReadX 14064 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 14065
Close 14065
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 14058
ReadX 14064 0 4096 4096
ReadX 14064 4096 4096 4096
ReadX 14064 8192 4096 4096
ReadX 14064 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 14066
ReadX 14066 0 4096 4096
ReadX 14066 0 4096 4096
ReadX 14066 4096 4096 4096
ReadX 14066 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 14067
ReadX 14067 0 4096 4096
ReadX 14067 4096 4096 4096
ReadX 14067 8192 4096 4096
Close 14066
Close 14067
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 14068
WriteX 14068 15359 1 1
QUERY_FILE_INFORMATION 14068
WriteX 14068 0 15360 15360
Close 14068
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 14069
ReadX 14069 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 14064
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 14070
Close 14070
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 14071
ReadX 14071 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 14072
Close 14072
WriteX 14069 0 4096 4096
Close 14069
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 14073
Close 14073
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 14074
ReadX 14074 0 4096 4096
ReadX 14074 0 4096 4096
ReadX 14074 4096 4096 4096
ReadX 14074 8192 4096 4096
ReadX 14074 12288 3072 3072
ReadX 14074 0 8192 8192
ReadX 14074 8192 4096 4096
ReadX 14074 12288 3072 3072
WriteX 14074 15469 1 1
QUERY_FILE_INFORMATION 14074
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 14075
ReadX 14075 0 4096 4096
ReadX 14075 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 14076
WriteX 14076 52 1 1
QUERY_FILE_INFORMATION 14076
WriteX 14076 0 53 53
Close 14076
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 14077
Close 14077
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 14078
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 14075 0 8192 8192
ReadX 14075 8192 4096 4096
ReadX 14075 12288 4096 4096
WriteX 14078 12005 1 1
QUERY_FILE_INFORMATION 14078
WriteX 14078 0 12006 12006
Close 14078
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 14079
ReadX 14079 0 4096 4096
WriteX 14079 0 4096 4096
Close 14079
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 14080
Close 14080
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 14081
ReadX 14081 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 14082
Close 14082
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 14075
ReadX 14081 0 4096 4096
ReadX 14081 4096 4096 4096
ReadX 14081 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 14083
WriteX 14083 11990 1 1
QUERY_FILE_INFORMATION 14083
WriteX 14083 0 11991 11991
Close 14083
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 14084
ReadX 14084 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 14081
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 14085
Close 14085
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 14086
ReadX 14086 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 14087
Close 14087
WriteX 14084 0 4096 4096
Close 14084
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 14088
Close 14088
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 14089
ReadX 14089 0 4096 4096
ReadX 14089 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 14090
Close 14090
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 14089 0 8192 8192
ReadX 14089 8192 3799 3799
WriteX 14089 13247 1 1
QUERY_FILE_INFORMATION 14089
WriteX 14089 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 14089 0 8192 8192
ReadX 14089 8192 4096 4096
Close 14071
WriteX 14074 0 19054 19054
Close 14074
WriteX 14089 0 12288 12288
Close 14089
Close 14086
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 14091
Close 14091
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 14092
Close 14092
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14093
ReadX 14093 61440 4096 4096
ReadX 14093 126976 4096 4096
WriteX 14093 0 65471 65471
WriteX 14093 65471 65 65
WriteX 14093 65536 65471 65471
WriteX 14093 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14094
ReadX 14094 61440 4096 4096
ReadX 14094 126976 4096 4096
ReadX 14094 192512 4096 4096
ReadX 14094 258048 4096 4096
WriteX 14094 0 65471 65471
WriteX 14094 65471 65 65
WriteX 14094 65536 65471 65471
WriteX 14094 131007 65 65
WriteX 14094 131072 65471 65471
WriteX 14094 196543 65 65
WriteX 14094 196608 65471 65471
WriteX 14094 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14095
ReadX 14095 61440 4096 4096
ReadX 14095 126976 4096 4096
ReadX 14095 192512 4096 4096
ReadX 14095 258048 4096 4096
ReadX 14095 323584 4096 4096
ReadX 14095 389120 4096 4096
ReadX 14095 454656 4096 4096
ReadX 14095 520192 4096 4096
WriteX 14095 0 65471 65471
WriteX 14095 65471 65 65
WriteX 14095 65536 65471 65471
WriteX 14095 131007 65 65
WriteX 14095 131072 65471 65471
WriteX 14095 196543 65 65
WriteX 14095 196608 65471 65471
WriteX 14095 262079 65 65
WriteX 14095 262144 65471 65471
WriteX 14095 327615 65 65
WriteX 14095 327680 65471 65471
WriteX 14095 393151 65 65
WriteX 14095 393216 65471 65471
WriteX 14095 458687 65 65
WriteX 14095 458752 65471 65471
WriteX 14095 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12390
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12390 0 4096 4096
Close 12390
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12391
ReadX 12391 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12391
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12392
ReadX 12392 0 4096 4096
ReadX 12392 4096 4096 4096
ReadX 12392 8192 4096 4096
ReadX 12392 12288 4096 4096
ReadX 12392 16384 4096 4096
ReadX 12392 20480 4096 4096
ReadX 12392 24576 4096 4096
ReadX 12392 28672 4096 4096
ReadX 12392 32768 4096 4096
ReadX 12392 36864 4096 4096
ReadX 12392 40960 4096 4096
ReadX 12392 45056 4096 4096
ReadX 12392 49152 4096 4096
ReadX 12392 53248 4096 4096
ReadX 12392 57344 4096 4096
ReadX 12392 61440 4096 4096
ReadX 12392 65536 4096 4096
ReadX 12392 69632 4096 4096
ReadX 12392 73728 4096 4096
WriteX 12392 0 4096 4096
Close 12392
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12393
Close 12393
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12394
ReadX 12394 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12395
Close 12395
Close 14093
Close 14094
Close 14095
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12394
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12397
WriteX 12397 4607 1 1
QUERY_FILE_INFORMATION 12397
WriteX 12397 0 65471 65471
WriteX 12397 65471 65 65
WriteX 12397 65536 19979 19979
Close 12397
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12398
ReadX 12398 0 4096 4096
WriteX 12398 0 4096 4096
Flush 12398
WriteX 12398 0 4096 4096
Flush 12398
QUERY_FILE_INFORMATION 12398
WriteX 12398 0 4096 4096
Flush 12398
WriteX 12398 0 4096 4096
Flush 12398
WriteX 12398 0 4096 4096
Flush 12398
WriteX 12398 0 4096 4096
Flush 12398
Close 12398
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12399
ReadX 12399 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 12400
ReadX 12400 0 4096 4096
Close 12399
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12401
ReadX 12401 0 4096 4096
Close 12401
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12402
ReadX 12402 0 4096 4096
Close 12402
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12403
ReadX 12403 0 4096 4096
WriteX 12403 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 12404
Close 12404
Close 12400
Close 12403
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12405
Close 12405
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12407
WriteX 12407 4607 1 1
QUERY_FILE_INFORMATION 12407
WriteX 12407 0 65471 65471
WriteX 12407 65471 65 65
WriteX 12407 65536 17654 17654
Close 12407
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12408
ReadX 12408 0 4096 4096
WriteX 12408 0 4096 4096
Flush 12408
WriteX 12408 0 4096 4096
Flush 12408
QUERY_FILE_INFORMATION 12408
WriteX 12408 0 4096 4096
Flush 12408
WriteX 12408 0 4096 4096
Flush 12408
WriteX 12408 0 4096 4096
Flush 12408
WriteX 12408 0 4096 4096
Flush 12408
Close 12408
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12409
Close 12409
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12410
ReadX 12410 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 12411
Close 12411
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 12412
ReadX 12412 0 4096 4096
ReadX 12412 4096 4096 4096
ReadX 12412 8192 4096 4096
ReadX 12412 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12412 16384 4096 4096
ReadX 12412 20480 4096 4096
ReadX 12412 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 12410
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12413
ReadX 12413 0 4096 4096
Close 12413
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12414
ReadX 12414 0 4096 4096
Close 12414
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12415
ReadX 12415 0 4096 4096
WriteX 12415 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 12416
Close 12416
Close 12415
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12417
Close 12417
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12419
WriteX 12419 4607 1 1
QUERY_FILE_INFORMATION 12419
WriteX 12419 0 65471 65471
WriteX 12419 65471 65 65
WriteX 12419 65536 19490 19490
Close 12419
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12420
ReadX 12420 0 4096 4096
WriteX 12420 0 4096 4096
Flush 12420
WriteX 12420 0 4096 4096
Flush 12420
QUERY_FILE_INFORMATION 12420
WriteX 12420 0 4096 4096
Flush 12420
WriteX 12420 0 4096 4096
Flush 12420
WriteX 12420 0 4096 4096
Flush 12420
WriteX 12420 0 4096 4096
Flush 12420
Close 12420
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12421
Close 12421
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12422
ReadX 12422 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 12423
Close 12423
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12422
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12424
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12424 0 4096 4096
Close 12424
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12425
ReadX 12425 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12425
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12426
ReadX 12426 0 4096 4096
ReadX 12426 4096 4096 4096
ReadX 12426 8192 4096 4096
ReadX 12426 12288 4096 4096
ReadX 12426 16384 4096 4096
ReadX 12426 20480 4096 4096
ReadX 12426 24576 4096 4096
ReadX 12426 28672 4096 4096
ReadX 12426 32768 4096 4096
ReadX 12426 36864 4096 4096
ReadX 12426 40960 4096 4096
ReadX 12426 45056 4096 4096
ReadX 12426 49152 4096 4096
ReadX 12426 53248 4096 4096
ReadX 12426 57344 4096 4096
ReadX 12426 61440 4096 4096
ReadX 12426 65536 4096 4096
ReadX 12426 69632 4096 4096
ReadX 12426 73728 4096 4096
WriteX 12426 0 4096 4096
Close 12426
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12427
Close 12427
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12428
ReadX 12428 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12429
Close 12429
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12428
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12431
WriteX 12431 4607 1 1
QUERY_FILE_INFORMATION 12431
WriteX 12431 0 65471 65471
WriteX 12431 65471 65 65
WriteX 12431 65536 8866 8866
Close 12431
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12432
ReadX 12432 0 4096 4096
WriteX 12432 0 4096 4096
Flush 12432
WriteX 12432 0 4096 4096
Flush 12432
Close 12432
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12433
ReadX 12433 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12433
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12434
ReadX 12434 0 4096 4096
Close 12434
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12435
ReadX 12435 0 4096 4096
Close 12435
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12436
ReadX 12436 0 4096 4096
WriteX 12436 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 12437
Close 12437
Close 12436
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12438
Close 12438
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12440
WriteX 12440 4607 1 1
QUERY_FILE_INFORMATION 12440
WriteX 12440 0 65471 65471
WriteX 12440 65471 65 65
WriteX 12440 65536 9298 9298
Close 12440
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12441
ReadX 12441 0 4096 4096
WriteX 12441 0 4096 4096
Flush 12441
WriteX 12441 0 4096 4096
Flush 12441
Close 12441
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12442
Close 12442
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12443
ReadX 12443 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 12444
Close 12444
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12446
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12446 0 4096 4096
Close 12446
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12447
ReadX 12447 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12447 4096 4096 4096
ReadX 12447 8192 4096 4096
ReadX 12447 12288 4096 4096
ReadX 12447 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 12443
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12448
ReadX 12448 0 4096 4096
Close 12448
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12449
ReadX 12449 0 4096 4096
Close 12449
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12450
ReadX 12450 0 4096 4096
WriteX 12450 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 12451
Close 12451
Close 12447
Close 12450
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12452
Close 12452
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12454
WriteX 12454 4607 1 1
QUERY_FILE_INFORMATION 12454
WriteX 12454 0 65471 65471
WriteX 12454 65471 65 65
WriteX 12454 65536 11540 11540
Close 12454
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12455
ReadX 12455 0 4096 4096
WriteX 12455 0 4096 4096
Flush 12455
WriteX 12455 0 4096 4096
Flush 12455
Close 12455
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12456
Close 12456
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12457
ReadX 12457 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 12458
Close 12458
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12457
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12459
ReadX 12459 0 65471 65471
ReadX 12459 65471 65 65
ReadX 12459 65536 65471 65471
ReadX 12459 131007 65 65
ReadX 12459 131072 65471 65471
ReadX 12459 196543 65 65
ReadX 12459 196608 65471 65471
ReadX 12459 262079 65 65
ReadX 12459 262144 65471 65471
ReadX 12459 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12460
ReadX 12460 0 65471 65471
ReadX 12460 65471 65 65
ReadX 12460 65536 65471 65471
ReadX 12460 131007 65 65
ReadX 12460 131072 65471 65471
ReadX 12460 196543 65 65
ReadX 12460 196608 65471 65471
ReadX 12460 262079 65 65
ReadX 12460 262144 65471 65471
ReadX 12460 327615 65 65
ReadX 12460 327680 65471 65471
ReadX 12460 393151 65 65
ReadX 12460 393216 65471 65471
ReadX 12460 458687 65 65
ReadX 12460 458752 65471 65471
ReadX 12460 524223 65 65
ReadX 12460 524288 65471 65471
ReadX 12460 589759 65 65
ReadX 12460 589824 65471 65471
ReadX 12460 655295 65 65
ReadX 12460 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12461
ReadX 12461 0 65471 65471
ReadX 12461 65471 65 65
ReadX 12461 65536 65471 65471
ReadX 12461 131007 65 65
Close 12412
ReadX 12461 131072 65471 65471
Close 12459
ReadX 12461 196543 65 65
Close 12460
ReadX 12461 196608 65471 65471
ReadX 12461 262079 65 65
ReadX 12461 262144 65471 65471
ReadX 12461 327615 65 65
ReadX 12461 327680 65471 65471
ReadX 12461 393151 65 65
ReadX 12461 393216 65471 65471
ReadX 12461 458687 65 65
ReadX 12461 458752 65471 65471
ReadX 12461 524223 65 65
ReadX 12461 524288 65471 65471
ReadX 12461 589759 65 65
ReadX 12461 589824 65471 65471
ReadX 12461 655295 65 65
ReadX 12461 655360 65471 65471
ReadX 12461 720831 65 65
ReadX 12461 720896 65471 65471
ReadX 12461 786367 65 65
ReadX 12461 786432 65471 65471
ReadX 12461 851903 65 65
ReadX 12461 851968 65471 65471
ReadX 12461 917439 65 65
ReadX 12461 917504 65471 65471
ReadX 12461 982975 65 65
ReadX 12461 983040 65471 65471
ReadX 12461 1048511 65 65
ReadX 12461 1048576 65471 65471
ReadX 12461 1114047 65 65
ReadX 12461 1114112 65471 65471
ReadX 12461 1179583 65 65
ReadX 12461 1179648 65471 65471
ReadX 12461 1245119 65 65
ReadX 12461 1245184 65471 65471
ReadX 12461 1310655 65 65
ReadX 12461 1310720 65471 65471
ReadX 12461 1376191 65 65
ReadX 12461 1376256 65471 65471
ReadX 12461 1441727 65 65
ReadX 12461 1441792 65471 65471
ReadX 12461 1507263 65 65
ReadX 12461 1507328 65471 65471
ReadX 12461 1572799 65 65
ReadX 12461 1572864 65471 65471
ReadX 12461 1638335 65 65
ReadX 12461 1638400 65471 65471
ReadX 12461 1703871 65 65
ReadX 12461 1703936 65471 65471
ReadX 12461 1769407 65 65
ReadX 12461 1769472 65471 65471
ReadX 12461 1834943 65 65
ReadX 12461 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12462
FIND_FIRST \clients\client1\~dmtmp\*
Close 12462
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12463
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12464
QUERY_FILE_INFORMATION 12464
QUERY_FILE_INFORMATION 12464
QUERY_FILE_INFORMATION 12464
ReadX 12464 2156 24 24
ReadX 12464 2139 276 276
ReadX 12464 2136 14 14
ReadX 12464 2136 7 7
ReadX 12464 2138 12 12
ReadX 12464 2137 8 8
ReadX 12464 2135 15 15
ReadX 12464 0 16 16
ReadX 12464 16 2048 2048
ReadX 12464 2064 2048 2048
ReadX 12464 257 2048 2048
ReadX 12464 385 2048 2048
ReadX 12464 513 2048 2048
ReadX 12464 641 2048 2048
ReadX 12464 769 2048 2048
ReadX 12464 897 2048 2048
ReadX 12464 1025 2048 2048
ReadX 12464 1153 2048 2048
ReadX 12464 1281 2048 2048
ReadX 12464 1409 2048 2048
ReadX 12464 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12466
Close 12466
Close 12461
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12468
WriteX 12468 15 1 1
QUERY_FILE_INFORMATION 12468
WriteX 12468 0 10575 10575
Flush 12468
Close 12468
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12469
Close 12469
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12470
ReadX 12470 0 4096 4096
Close 12464
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12471
Close 12471
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12472
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12473
QUERY_FILE_INFORMATION 12473
ReadX 12473 0 512 512
ReadX 12473 512 512 512
ReadX 12473 1024 512 512
QUERY_FILE_INFORMATION 12473
QUERY_FILE_INFORMATION 12473
Close 12473
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12474
QUERY_FILE_INFORMATION 12474
ReadX 12474 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12475
QUERY_FILE_INFORMATION 12475
ReadX 12475 0 512 512
ReadX 12475 512 512 512
ReadX 12475 1024 512 512
ReadX 12475 288 20 20
ReadX 12475 308 2084 2084
ReadX 12475 388 2084 2084
ReadX 12475 388 2084 2084
ReadX 12463 2157 1386 1386
ReadX 12475 2472 399 399
ReadX 12475 3072 1536 1536
ReadX 12475 544 149 149
ReadX 12475 693 485 485
Close 12475
ReadX 12463 2157 4096 4096
ReadX 12463 6253 4096 4096
ReadX 12463 10349 4096 4096
ReadX 12463 14445 4096 4096
ReadX 12463 18541 4096 4096
ReadX 12463 22637 256 256
ReadX 12463 22893 4096 4096
ReadX 12463 26989 4096 4096
ReadX 12463 31085 4096 4096
ReadX 12463 35181 4096 4096
ReadX 12463 39277 4096 4096
ReadX 12463 43373 4096 4096
ReadX 12463 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12463 2157 1024 1024
ReadX 12463 1667 4688 4688
ReadX 12463 6355 3516 3516
ReadX 12463 9871 16384 16384
ReadX 12463 26255 3771 3771
ReadX 12463 30026 2048 2048
ReadX 12463 32074 1024 1024
ReadX 12463 33098 6652 6652
ReadX 12463 39750 16384 16384
ReadX 12463 56134 10496 10496
ReadX 12463 66630 1784 1784
ReadX 12463 68414 90 90
ReadX 12463 68504 273 273
ReadX 12463 68777 1600 1600
ReadX 12463 70377 640 640
ReadX 12463 71017 1280 1280
ReadX 12463 72297 8464 8464
ReadX 12463 80761 158 158
ReadX 12463 80919 912 912
ReadX 12463 81831 1980 1980
ReadX 12463 83811 2256 2256
ReadX 12463 86067 400 400
ReadX 12463 86467 252 252
ReadX 12463 86719 42 42
ReadX 12463 86761 725 725
ReadX 12463 2009 512 512
ReadX 12463 3895 9 9
ReadX 12463 3781 46 46
ReadX 12463 4059 92 92
ReadX 12463 3781 92 92
ReadX 12463 3986 184 184
ReadX 12463 3987 16384 16384
ReadX 12463 3902 16384 16384
ReadX 12463 3781 10240 10240
ReadX 12463 3821 16384 16384
ReadX 12463 3891 935 935
ReadX 12463 4060 10240 10240
ReadX 12463 4059 184 184
ReadX 12463 256 184 184
ReadX 12463 256 1026 1026
ReadX 12463 3901 326 326
ReadX 12463 3899 652 652
ReadX 12463 256 2 2
ReadX 12463 258 4948 4948
Close 12463
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12477
Close 12477
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12479
WriteX 12479 4055 1 1
QUERY_FILE_INFORMATION 12479
WriteX 12479 0 65471 65471
WriteX 12479 65471 65 65
WriteX 12479 65536 65471 65471
WriteX 12479 131007 65 65
WriteX 12479 131072 65471 65471
WriteX 12479 196543 65 65
WriteX 12479 196608 65471 65471
WriteX 12479 262079 65 65
WriteX 12479 262144 65471 65471
WriteX 12479 327615 65 65
WriteX 12479 327680 65471 65471
WriteX 12479 393151 65 65
WriteX 12479 393216 65471 65471
WriteX 12479 458687 65 65
WriteX 12479 458752 65471 65471
WriteX 12479 524223 65 65
WriteX 12479 524288 65471 65471
WriteX 12479 589759 65 65
WriteX 12479 589824 35257 35257
Close 12479
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12481
Close 12481
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12483
WriteX 12483 4055 1 1
QUERY_FILE_INFORMATION 12483
WriteX 12483 0 65471 65471
WriteX 12483 65471 65 65
WriteX 12483 65536 65471 65471
WriteX 12483 131007 65 65
WriteX 12483 131072 65471 65471
WriteX 12483 196543 65 65
WriteX 12483 196608 65471 65471
WriteX 12483 262079 65 65
WriteX 12483 262144 65471 65471
WriteX 12483 327615 65 65
WriteX 12483 327680 65471 65471
WriteX 12483 393151 65 65
WriteX 12483 393216 65471 65471
WriteX 12483 458687 65 65
WriteX 12483 458752 65471 65471
WriteX 12483 524223 65 65
WriteX 12483 524288 65471 65471
WriteX 12483 589759 65 65
WriteX 12483 589824 57598 57598
Close 12483
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12485
WriteX 12485 15 1 1
QUERY_FILE_INFORMATION 12485
WriteX 12485 0 12543 12543
Flush 12485
Close 12485
Close 12470
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12486
Close 12486
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12487
ReadX 12487 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12488
FIND_FIRST \clients\client1\~dmtmp\*
Close 12488
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12489
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12490
QUERY_FILE_INFORMATION 12490
QUERY_FILE_INFORMATION 12490
QUERY_FILE_INFORMATION 12490
ReadX 12490 1938 24 24
ReadX 12490 1920 276 276
ReadX 12490 1918 14 14
ReadX 12490 1918 7 7
ReadX 12490 1919 12 12
ReadX 12490 1919 8 8
ReadX 12490 1917 15 15
ReadX 12490 0 16 16
ReadX 12490 16 2048 2048
ReadX 12490 2064 2048 2048
ReadX 12490 257 2048 2048
ReadX 12490 385 2048 2048
ReadX 12490 513 2048 2048
ReadX 12490 641 2048 2048
ReadX 12490 769 2048 2048
ReadX 12490 897 2048 2048
ReadX 12490 1025 2048 2048
ReadX 12490 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12492
Close 12492
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12494
WriteX 12494 15 1 1
QUERY_FILE_INFORMATION 12494
WriteX 12494 0 11588 11588
Flush 12494
Close 12494
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12495
Close 12495
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12496
ReadX 12496 0 4096 4096
Close 12490
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12498
WriteX 12498 15 1 1
QUERY_FILE_INFORMATION 12498
WriteX 12498 0 11615 11615
Flush 12498
Close 12498
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12496
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12499
Close 12499
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12500
ReadX 12500 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12502
Close 12502
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12504
WriteX 12504 4088 1 1
QUERY_FILE_INFORMATION 12504
WriteX 12504 0 65471 65471
WriteX 12504 65471 65 65
WriteX 12504 65536 16050 16050
Close 12504
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12489 1939 64 64
ReadX 12489 128 248 248
ReadX 12489 128 568 568
ReadX 12489 3872 1536 1536
ReadX 12489 3456 2560 2560
ReadX 12489 3136 512 512
ReadX 12489 2880 4096 4096
ReadX 12489 3264 3072 3072
ReadX 12489 320 4096 4096
ReadX 12489 1024 4096 4096
ReadX 12489 3616 4096 4096
ReadX 12489 1939 64 64
ReadX 12489 128 248 248
ReadX 12489 128 608 608
ReadX 12489 2858 1024 1024
ReadX 12489 2810 4096 4096
ReadX 12489 2826 4096 4096
ReadX 12489 2580 2048 2048
ReadX 12489 2800 2560 2560
ReadX 12489 2100 4096 4096
ReadX 12489 2084 4096 4096
ReadX 12489 868 4096 4096
ReadX 12489 2324 4096 4096
ReadX 12489 884 4096 4096
ReadX 12489 2604 1024 1024
ReadX 12489 580 4096 4096
ReadX 12489 596 4096 4096
ReadX 12489 2752 4096 4096
ReadX 12489 2842 1024 1024
ReadX 12489 660 4096 4096
ReadX 12489 2720 4096 4096
ReadX 12489 2736 4096 4096
ReadX 12489 628 4096 4096
ReadX 12489 2704 4096 4096
ReadX 12489 1556 4096 4096
ReadX 12489 576 4096 4096
ReadX 12489 3168 1536 1536
ReadX 12489 832 4096 4096
ReadX 12489 1088 4096 4096
ReadX 12489 1344 4096 4096
ReadX 12489 1600 4096 4096
ReadX 12489 1856 4096 4096
ReadX 12489 2112 4096 4096
ReadX 12489 1892 4096 4096
ReadX 12489 820 4096 4096
ReadX 12489 788 4096 4096
ReadX 12489 1604 4096 4096
ReadX 12489 3648 4096 4096
ReadX 12489 2608 4096 4096
ReadX 12489 548 4096 4096
ReadX 12489 740 4096 4096
ReadX 12489 1344 4096 4096
ReadX 12489 3392 4096 4096
ReadX 12489 3904 4096 4096
ReadX 12489 644 4096 4096
ReadX 12489 676 4096 4096
ReadX 12489 2688 4096 4096
ReadX 12489 320 4096 4096
ReadX 12489 900 4096 4096
ReadX 12489 1908 4096 4096
ReadX 12489 852 4096 4096
ReadX 12489 724 4096 4096
ReadX 12489 2292 4096 4096
ReadX 12489 612 4096 4096
ReadX 12489 388 4096 4096
ReadX 12489 2368 4096 4096
ReadX 12489 2624 4096 4096
ReadX 12489 500 4096 4096
ReadX 12489 356 4096 4096
ReadX 12489 1024 4096 4096
ReadX 12489 576 4096 4096
ReadX 12489 340 4096 4096
ReadX 12489 420 4096 4096
ReadX 12489 1600 4096 4096
ReadX 12489 404 4096 4096
ReadX 12489 1428 4096 4096
ReadX 12489 2656 4096 4096
ReadX 12489 2624 4096 4096
ReadX 12489 452 4096 4096
ReadX 12489 692 4096 4096
ReadX 12489 564 4096 4096
ReadX 12489 372 4096 4096
ReadX 12489 468 4096 4096
ReadX 12489 484 4096 4096
ReadX 12489 1088 4096 4096
ReadX 12489 1924 4096 4096
ReadX 12489 2768 4096 4096
ReadX 12489 832 4096 4096
ReadX 12489 836 4096 4096
ReadX 12489 1856 4096 4096
ReadX 12489 2640 4096 4096
ReadX 12489 436 4096 4096
ReadX 12489 1828 4096 4096
ReadX 12489 804 4096 4096
ReadX 12489 1860 4096 4096
ReadX 12489 1812 4096 4096
ReadX 12489 756 4096 4096
ReadX 12489 1636 4096 4096
ReadX 12489 772 4096 4096
ReadX 12489 2036 4096 4096
ReadX 12489 1220 4096 4096
ReadX 12489 1652 4096 4096
ReadX 12489 2588 4096 4096
ReadX 12489 916 4096 4096
ReadX 12489 260 4096 4096
ReadX 12489 932 4096 4096
ReadX 12489 2624 4096 4096
ReadX 12489 308 4096 4096
ReadX 12489 292 4096 4096
ReadX 12489 1140 4096 4096
ReadX 12489 276 4096 4096
ReadX 12489 2020 4096 4096
ReadX 12489 2880 4096 4096
ReadX 12489 516 4096 4096
ReadX 12489 1844 4096 4096
ReadX 12489 1124 4096 4096
ReadX 12489 3136 4096 4096
ReadX 12489 324 4096 4096
ReadX 12489 1156 4096 4096
ReadX 12489 1172 4096 4096
ReadX 12489 2112 4096 4096
ReadX 12489 2368 4096 4096
ReadX 12489 964 4096 4096
ReadX 12489 980 4096 4096
ReadX 12489 1012 4096 4096
ReadX 12489 532 4096 4096
ReadX 12489 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12489 1620 4096 4096
ReadX 12489 1604 4096 4096
ReadX 12489 2116 4096 4096
ReadX 12489 2132 4096 4096
ReadX 12489 2148 4096 4096
ReadX 12489 2276 4096 4096
ReadX 12489 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12506
Close 12506
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12508
QUERY_FILE_INFORMATION 12472
Close 12472
WriteX 12508 4088 1 1
QUERY_FILE_INFORMATION 12508
QUERY_FILE_INFORMATION 12474
Close 12474
WriteX 12508 0 65471 65471
WriteX 12508 65471 65 65
WriteX 12508 65536 64850 64850
Close 12508
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12510
WriteX 12510 15 1 1
QUERY_FILE_INFORMATION 12510
ReadX 12489 2068 4096 4096
ReadX 12489 1588 4096 4096
ReadX 12489 1572 4096 4096
WriteX 12510 0 18630 18630
Flush 12510
Close 12510
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12500
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12511
Close 12511
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12512
ReadX 12512 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 12489 612 4096 4096
ReadX 12489 564 4096 4096
ReadX 12489 1876 4096 4096
ReadX 12489 628 4096 4096
ReadX 12489 740 4096 4096
ReadX 12489 724 4096 4096
ReadX 12489 644 4096 4096
ReadX 12489 2324 4096 4096
ReadX 12489 660 4096 4096
ReadX 12489 852 4096 4096
ReadX 12489 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 12489 2368 4096 4096
ReadX 12489 1024 4096 4096
ReadX 12489 320 4096 4096
ReadX 12489 580 4096 4096
ReadX 12489 3136 512 512
ReadX 12489 2880 4096 4096
Close 12489
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12513
ReadX 12513 61440 4096 4096
ReadX 12513 126976 4096 4096
WriteX 12513 0 65471 65471
WriteX 12513 65471 65 65
WriteX 12513 65536 65471 65471
WriteX 12513 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12514
ReadX 12514 61440 4096 4096
ReadX 12514 126976 4096 4096
ReadX 12514 192512 4096 4096
ReadX 12514 258048 4096 4096
WriteX 12514 0 65471 65471
WriteX 12514 65471 65 65
WriteX 12514 65536 65471 65471
WriteX 12514 131007 65 65
WriteX 12514 131072 65471 65471
WriteX 12514 196543 65 65
WriteX 12514 196608 65471 65471
WriteX 12514 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12515
ReadX 12515 61440 4096 4096
ReadX 12515 126976 4096 4096
ReadX 12515 192512 4096 4096
ReadX 12515 258048 4096 4096
ReadX 12515 323584 4096 4096
ReadX 12515 389120 4096 4096
ReadX 12515 454656 4096 4096
ReadX 12515 520192 4096 4096
WriteX 12515 0 65471 65471
WriteX 12515 65471 65 65
WriteX 12515 65536 65471 65471
WriteX 12515 131007 65 65
WriteX 12515 131072 65471 65471
WriteX 12515 196543 65 65
WriteX 12515 196608 65471 65471
WriteX 12515 262079 65 65
WriteX 12515 262144 65471 65471
WriteX 12515 327615 65 65
WriteX 12515 327680 65471 65471
WriteX 12515 393151 65 65
WriteX 12515 393216 65471 65471
WriteX 12515 458687 65 65
WriteX 12515 458752 65471 65471
WriteX 12515 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12516
Close 12516
Close 12512
Close 12487
Close 12513
Close 12514
Close 12515
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12517
Close 12517
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 12520
Close 12520
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 12522
Close 12522
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 12523
Close 12523
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12526
Close 12526
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12528
Close 12528
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12529
Close 12529
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12532
Close 12532
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12536
Close 12536
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12540
Close 12540
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12544
Close 12544
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12548
Close 12548
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12552
Close 12552
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12556
Close 12556
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12560
Close 12560
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12562
Close 12562
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12564
Close 12564
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12566
WriteX 12566 4095 1 1
QUERY_FILE_INFORMATION 12566
QUERY_FS_INFORMATION 259
WriteX 12566 0 65471 65471
WriteX 12566 65471 65 65
WriteX 12566 65536 65471 65471
WriteX 12566 131007 65 65
WriteX 12566 131072 65471 65471
WriteX 12566 196543 65 65
WriteX 12566 196608 65471 65471
WriteX 12566 262079 65 65
WriteX 12566 262144 26634 26634
Close 12566
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12571
Close 12571
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12572
Close 12572
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12573
ReadX 12573 0 4096 4096
Close 12573
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12574
ReadX 12574 0 4096 4096
ReadX 12574 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12575
Close 12575
Close 12574
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12578
Close 12578
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12580
Close 12580
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12581
Close 12581
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12584
Close 12584
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12586
Close 12586
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12587
Close 12587
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12590
Close 12590
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12594
Close 12594
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12598
Close 12598
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12602
Close 12602
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12606
Close 12606
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12610
Close 12610
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12613
Close 12613
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12617
Close 12617
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12621
Close 12621
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 12623
Close 12623
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 12624
Close 12624
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12633
Close 12633
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12634
FIND_FIRST \clients\client1\~dmtmp\*
Close 12634
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12635
Close 12635
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12636
ReadX 12636 0 4096 4096
Close 12636
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12637
ReadX 12637 0 4096 4096
Close 12637
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12638
ReadX 12638 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12648
Close 12648
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12649
FIND_FIRST \clients\client1\~dmtmp\*
Close 12649
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12650
Close 12650
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12651
ReadX 12651 0 4096 4096
Close 12651
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12652
ReadX 12652 0 4096 4096
Close 12652
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12653
ReadX 12653 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12654
ReadX 12654 0 65471 65471
ReadX 12654 65471 65 65
ReadX 12654 65536 65471 65471
ReadX 12654 131007 65 65
ReadX 12654 131072 65471 65471
ReadX 12654 196543 65 65
ReadX 12654 196608 65471 65471
ReadX 12654 262079 65 65
ReadX 12654 262144 65471 65471
ReadX 12654 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12655
ReadX 12655 0 65471 65471
ReadX 12655 65471 65 65
ReadX 12655 65536 65471 65471
ReadX 12655 131007 65 65
ReadX 12655 131072 65471 65471
ReadX 12655 196543 65 65
ReadX 12655 196608 65471 65471
ReadX 12655 262079 65 65
ReadX 12655 262144 65471 65471
ReadX 12655 327615 65 65
ReadX 12655 327680 65471 65471
ReadX 12655 393151 65 65
ReadX 12655 393216 65471 65471
ReadX 12655 458687 65 65
ReadX 12655 458752 65471 65471
ReadX 12655 524223 65 65
ReadX 12655 524288 65471 65471
ReadX 12655 589759 65 65
ReadX 12655 589824 65471 65471
ReadX 12655 655295 65 65
ReadX 12655 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12656
ReadX 12656 0 65471 65471
ReadX 12656 65471 65 65
ReadX 12656 65536 65471 65471
ReadX 12656 131007 65 65
ReadX 12656 131072 65471 65471
ReadX 12656 196543 65 65
ReadX 12656 196608 65471 65471
ReadX 12656 262079 65 65
ReadX 12656 262144 65471 65471
ReadX 12656 327615 65 65
ReadX 12656 327680 65471 65471
ReadX 12656 393151 65 65
ReadX 12656 393216 65471 65471
ReadX 12656 458687 65 65
ReadX 12656 458752 65471 65471
ReadX 12656 524223 65 65
ReadX 12656 524288 65471 65471
ReadX 12656 589759 65 65
ReadX 12656 589824 65471 65471
ReadX 12656 655295 65 65
ReadX 12656 655360 65471 65471
Close 12638
ReadX 12656 720831 65 65
ReadX 12656 720896 65471 65471
Close 12653
ReadX 12656 786367 65 65
ReadX 12656 786432 65471 65471
Close 12654
ReadX 12656 851903 65 65
Close 12655
ReadX 12656 851968 65471 65471
ReadX 12656 917439 65 65
ReadX 12656 917504 65471 65471
ReadX 12656 982975 65 65
ReadX 12656 983040 65471 65471
ReadX 12656 1048511 65 65
ReadX 12656 1048576 65471 65471
ReadX 12656 1114047 65 65
ReadX 12656 1114112 65471 65471
ReadX 12656 1179583 65 65
ReadX 12656 1179648 65471 65471
ReadX 12656 1245119 65 65
ReadX 12656 1245184 65471 65471
ReadX 12656 1310655 65 65
ReadX 12656 1310720 65471 65471
ReadX 12656 1376191 65 65
ReadX 12656 1376256 65471 65471
ReadX 12656 1441727 65 65
ReadX 12656 1441792 65471 65471
ReadX 12656 1507263 65 65
ReadX 12656 1507328 65471 65471
ReadX 12656 1572799 65 65
ReadX 12656 1572864 65471 65471
ReadX 12656 1638335 65 65
ReadX 12656 1638400 65471 65471
ReadX 12656 1703871 65 65
ReadX 12656 1703936 65471 65471
ReadX 12656 1769407 65 65
ReadX 12656 1769472 65471 65471
ReadX 12656 1834943 65 65
ReadX 12656 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12657
ReadX 12657 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12657 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12657 8192 4096 4096
ReadX 12657 12288 4096 4096
ReadX 12657 16384 4096 4096
ReadX 12657 20480 4096 4096
ReadX 12657 24576 4096 4096
ReadX 12657 28672 4096 4096
ReadX 12657 32768 4096 4096
ReadX 12657 36864 4096 4096
ReadX 12657 40960 4096 4096
ReadX 12657 45056 4096 4096
ReadX 12657 49152 4096 4096
ReadX 12657 53248 4096 4096
ReadX 12657 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12657 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 12658
Close 12658
Close 12656
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 12659
WriteX 12659 1535 1 1
QUERY_FILE_INFORMATION 12659
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12657 0 4096 4096
ReadX 12657 4096 4096 4096
QUERY_FILE_INFORMATION 12659
WriteX 12659 0 57088 57088
WriteX 12659 0 4096 4096
Flush 12659
Close 12657
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12660
Close 12660
WriteX 12659 0 4096 4096
Close 12659
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 12661
Close 12661
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12662
ReadX 12662 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12662 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 12663
WriteX 12663 1535 1 1
QUERY_FILE_INFORMATION 12663
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12662 0 4096 4096
QUERY_FILE_INFORMATION 12663
WriteX 12663 0 51456 51456
WriteX 12663 0 4096 4096
Flush 12663
Close 12662
WriteX 12663 0 4096 4096
Close 12663
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 12664
Close 12664
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12665
ReadX 12665 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12665 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12667
Close 12667
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12669
WriteX 12669 4045 1 1
QUERY_FILE_INFORMATION 12669
WriteX 12669 0 53077 53077
Close 12669
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 12670
WriteX 12670 1535 1 1
QUERY_FILE_INFORMATION 12670
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12665 0 4096 4096
QUERY_FILE_INFORMATION 12670
WriteX 12670 0 65471 65471
WriteX 12670 65471 65 65
WriteX 12670 65536 1856 1856
WriteX 12670 0 4096 4096
Flush 12670
Close 12665
WriteX 12670 0 4096 4096
Close 12670
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 12671
Close 12671
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12672
ReadX 12672 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12674
Close 12674
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12676
WriteX 12676 4076 1 1
QUERY_FILE_INFORMATION 12676
WriteX 12676 0 7983 7983
Close 12676
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12678
Close 12678
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12680
WriteX 12680 4095 1 1
QUERY_FILE_INFORMATION 12680
WriteX 12680 0 65471 65471
WriteX 12680 65471 65 65
WriteX 12680 65536 65471 65471
WriteX 12680 131007 65 65
WriteX 12680 131072 65471 65471
WriteX 12680 196543 65 65
WriteX 12680 196608 65471 65471
WriteX 12680 262079 65 65
WriteX 12680 262144 65471 65471
WriteX 12680 327615 65 65
WriteX 12680 327680 65471 65471
WriteX 12680 393151 65 65
WriteX 12680 393216 65471 65471
WriteX 12680 458687 65 65
WriteX 12680 458752 46731 46731
Close 12680
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 12681
WriteX 12681 1535 1 1
QUERY_FILE_INFORMATION 12681
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12672 0 4096 4096
ReadX 12672 4096 4096 4096
QUERY_FILE_INFORMATION 12681
WriteX 12681 0 65471 65471
WriteX 12681 65471 65 65
WriteX 12681 65536 22848 22848
WriteX 12681 0 4096 4096
Flush 12681
Close 12672
WriteX 12681 0 4096 4096
Close 12681
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 12682
Close 12682
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12683
ReadX 12683 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12683 4096 4096 4096
Close 12683
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12684
ReadX 12684 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12684 0 8192 8192
ReadX 12684 8192 4096 4096
ReadX 12684 12288 4096 4096
ReadX 12684 16384 4096 4096
ReadX 12684 20480 4096 4096
ReadX 12684 24576 4096 4096
ReadX 12684 28672 4096 4096
ReadX 12684 32768 4096 4096
ReadX 12684 36864 4096 4096
ReadX 12684 40960 4096 4096
ReadX 12684 45056 4096 4096
ReadX 12684 49152 4096 4096
ReadX 12684 53248 4096 4096
ReadX 12684 57344 4096 4096
ReadX 12684 61440 4096 4096
ReadX 12684 65536 4096 4096
ReadX 12684 69632 4096 4096
ReadX 12684 73728 4096 4096
ReadX 12684 77824 4096 4096
ReadX 12684 81920 4096 4096
ReadX 12684 86016 4096 4096
ReadX 12684 90112 4096 4096
ReadX 12684 94208 4096 4096
ReadX 12684 98304 4096 4096
ReadX 12684 102400 4096 4096
ReadX 12684 106496 4096 4096
ReadX 12684 110592 4096 4096
ReadX 12684 114688 4096 4096
ReadX 12684 118784 4096 4096
ReadX 12684 122880 4096 4096
ReadX 12684 126976 4096 4096
ReadX 12684 131072 4096 4096
ReadX 12684 135168 4096 4096
ReadX 12684 139264 4096 4096
ReadX 12684 143360 4096 4096
ReadX 12684 147456 4096 4096
ReadX 12684 151552 4096 4096
ReadX 12684 155648 4096 4096
ReadX 12684 159744 4096 4096
ReadX 12684 163840 4096 4096
ReadX 12684 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12684 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 12685
Close 12685
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 12686
WriteX 12686 2047 1 1
QUERY_FILE_INFORMATION 12686
Close 12684
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12687
Close 12687
WriteX 12686 0 42388 42388
Close 12686
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 12688
Close 12688
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12689
ReadX 12689 0 4096 4096
ReadX 12689 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 12690
WriteX 12690 2047 1 1
QUERY_FILE_INFORMATION 12690
Close 12689
WriteX 12690 0 42652 42652
Close 12690
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 12691
Close 12691
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12692
ReadX 12692 0 4096 4096
ReadX 12692 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12694
Close 12694
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12696
WriteX 12696 4080 1 1
QUERY_FILE_INFORMATION 12696
WriteX 12696 0 65471 65471
WriteX 12696 65471 65 65
WriteX 12696 65536 49 49
Close 12696
Close 12692
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12697
ReadX 12697 61440 4096 4096
ReadX 12697 126976 4096 4096
WriteX 12697 0 65471 65471
WriteX 12697 65471 65 65
WriteX 12697 65536 65471 65471
WriteX 12697 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12698
ReadX 12698 61440 4096 4096
ReadX 12698 126976 4096 4096
ReadX 12698 192512 4096 4096
ReadX 12698 258048 4096 4096
WriteX 12698 0 65471 65471
WriteX 12698 65471 65 65
WriteX 12698 65536 65471 65471
WriteX 12698 131007 65 65
WriteX 12698 131072 65471 65471
WriteX 12698 196543 65 65
WriteX 12698 196608 65471 65471
WriteX 12698 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12699
ReadX 12699 61440 4096 4096
ReadX 12699 126976 4096 4096
ReadX 12699 192512 4096 4096
ReadX 12699 258048 4096 4096
ReadX 12699 323584 4096 4096
ReadX 12699 389120 4096 4096
ReadX 12699 454656 4096 4096
ReadX 12699 520192 4096 4096
WriteX 12699 0 65471 65471
WriteX 12699 65471 65 65
WriteX 12699 65536 65471 65471
WriteX 12699 131007 65 65
WriteX 12699 131072 65471 65471
WriteX 12699 196543 65 65
WriteX 12699 196608 65471 65471
WriteX 12699 262079 65 65
WriteX 12699 262144 65471 65471
WriteX 12699 327615 65 65
WriteX 12699 327680 65471 65471
WriteX 12699 393151 65 65
WriteX 12699 393216 65471 65471
WriteX 12699 458687 65 65
WriteX 12699 458752 65471 65471
WriteX 12699 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12700
FIND_FIRST \clients\client1\~dmtmp\*
Close 12700
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12701
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12701 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12702
ReadX 12702 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12703
ReadX 12703 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12704
ReadX 12704 0 4096 4096
ReadX 12701 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12701
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12705
ReadX 12705 0 4096 4096
ReadX 12705 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12706
FIND_FIRST \clients\client1\~dmtmp\*
Close 12706
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 12707
QUERY_FILE_INFORMATION 12707
WriteX 12707 2047 1 1
QUERY_FILE_INFORMATION 12707
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 12708
Close 12708
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12709
WriteX 12709 52 1 1
QUERY_FILE_INFORMATION 12709
WriteX 12709 0 491 491
Close 12709
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12710
ReadX 12710 0 491 491
WriteX 12707 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 12705
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12711
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12711 0 4096 4096
ReadX 12711 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 12713
Close 12713
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12714
WriteX 12714 52 1 1
QUERY_FILE_INFORMATION 12714
WriteX 12714 0 543 543
Close 12714
Close 12711
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
ReadX 12715 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12716
ReadX 12716 0 543 543
ReadX 12715 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12715
Close 12710
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12697
Close 12698
Close 12699
Close 12716
Close 12702
Close 12703
Close 12704
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12707
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12717
FIND_FIRST \clients\client1\~dmtmp\*
Close 12717
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12718
ReadX 12718 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12719
ReadX 12719 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12720
ReadX 12720 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12721
ReadX 12721 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12722
ReadX 12722 0 543 543
ReadX 12718 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 12726
FIND_FIRST \clients\client1\~dmtmp\*
Close 12726
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12727
QUERY_FILE_INFORMATION 12727
WriteX 12727 2047 1 1
QUERY_FILE_INFORMATION 12727
WriteX 12727 0 2048 2048
Close 12727
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12728
ReadX 12728 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12728
Close 12718
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12729
ReadX 12729 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 12729 4095 1 1
QUERY_FILE_INFORMATION 12729
ReadX 12729 0 4096 4096
WriteX 12729 0 4096 4096
Flush 12729
WriteX 12729 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12730
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12730 0 4096 4096
ReadX 12730 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 12734
FIND_FIRST \clients\client1\~dmtmp\*
Close 12734
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12735
WriteX 12735 2047 1 1
QUERY_FILE_INFORMATION 12735
WriteX 12735 0 2048 2048
Close 12735
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12736
ReadX 12736 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 12740
Close 12740
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12741
WriteX 12741 2047 1 1
QUERY_FILE_INFORMATION 12741
WriteX 12741 0 2048 2048
Close 12741
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12742
ReadX 12742 0 2048 2048
ReadX 12730 4096 16384 16384
Close 12742
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12743
ReadX 12743 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 12743
Close 12722
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 12736 4095 1 1
QUERY_FILE_INFORMATION 12736
ReadX 12736 0 4096 4096
WriteX 12736 0 4096 4096
Close 12736
WriteX 12730 0 8192 8192
Close 12730
WriteX 12719 0 4096 4096
WriteX 12720 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12745
ReadX 12745 0 4096 4096
ReadX 12745 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12745
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12746
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12746 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12747
ReadX 12747 0 543 543
ReadX 12746 0 4096 4096
Close 12746
Close 12729
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12748
QUERY_FILE_INFORMATION 12748
Close 12748
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12747
Close 12719
Close 12720
Close 12721
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12749
FIND_FIRST \clients\client1\~dmtmp\*
Close 12749
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12750
ReadX 12750 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12751
ReadX 12751 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12752
ReadX 12752 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12753
ReadX 12753 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12754
ReadX 12754 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12755
ReadX 12755 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12756
ReadX 12756 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12757
ReadX 12757 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12758
ReadX 12758 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12759
ReadX 12759 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12760
ReadX 12760 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12761
ReadX 12761 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12762
ReadX 12762 0 4096 4096
ReadX 12750 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12766
FIND_FIRST \clients\client1\~dmtmp\*
Close 12766
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12767
QUERY_FILE_INFORMATION 12767
WriteX 12767 2047 1 1
QUERY_FILE_INFORMATION 12767
WriteX 12767 0 2048 2048
Close 12767
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12768
ReadX 12768 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12768
Close 12758
Close 12750
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12769
ReadX 12769 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12770
FIND_FIRST \clients\client1\~dmtmp\*
Close 12770
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12771
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12771 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12772
ReadX 12772 0 4096 4096
ReadX 12771 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12776
FIND_FIRST \clients\client1\~dmtmp\*
Close 12776
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12777
QUERY_FILE_INFORMATION 12777
WriteX 12777 2047 1 1
QUERY_FILE_INFORMATION 12777
WriteX 12777 0 2048 2048
Close 12777
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12778
ReadX 12778 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12778
Close 12771
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12779
ReadX 12779 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12769 4095 1 1
QUERY_FILE_INFORMATION 12769
ReadX 12769 0 4096 4096
WriteX 12769 0 4096 4096
Flush 12769
WriteX 12779 4095 1 1
QUERY_FILE_INFORMATION 12779
ReadX 12779 0 4096 4096
WriteX 12779 0 4096 4096
Flush 12779
WriteX 12769 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 12779 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12780
ReadX 12780 0 4096 4096
ReadX 12772 0 4096 4096
ReadX 12780 0 4096 4096
ReadX 12780 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12781
FIND_FIRST \clients\client1\~dmtmp\*
Close 12781
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12782
WriteX 12782 4095 1 1
QUERY_FILE_INFORMATION 12782
WriteX 12782 0 4096 4096
Close 12782
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12783
ReadX 12783 0 4096 4096
Close 12780
Close 12772
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12784
Close 12784
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12785
WriteX 12785 4095 1 1
QUERY_FILE_INFORMATION 12785
WriteX 12785 0 4096 4096
Close 12785
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12786
ReadX 12786 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 12786 0 4096 4096
Close 12783
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12762
Close 12756
Close 12759
Close 12760
Close 12761
Close 12757
Close 12751
Close 12754
Close 12755
Close 12752
Close 12753
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12786
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12788
Close 12788
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12789
ReadX 12789 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12790
Close 12790
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12791
WriteX 12791 2047 1 1
QUERY_FILE_INFORMATION 12791
WriteX 12791 0 2048 2048
Close 12791
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12792
ReadX 12792 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12792
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12793
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12793 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12794
ReadX 12794 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12795
ReadX 12795 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12796
ReadX 12796 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12797
ReadX 12797 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12798
ReadX 12798 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12799
ReadX 12799 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12800
ReadX 12800 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12801
ReadX 12801 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12802
ReadX 12802 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12803
ReadX 12803 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12804
ReadX 12804 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12805
ReadX 12805 0 4096 4096
ReadX 12793 0 4096 4096
ReadX 12800 0 4096 4096
Close 12800
Close 12793
Close 12769
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12806
QUERY_FILE_INFORMATION 12806
Close 12806
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12789
Close 12804
Close 12799
Close 12801
Close 12802
Close 12803
Close 12805
Close 12794
Close 12797
Close 12798
Close 12795
Close 12796
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12779
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12807
QUERY_FILE_INFORMATION 12807
Close 12807
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12808
FIND_FIRST \clients\client1\~dmtmp\*
Close 12808
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12809
ReadX 12809 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12810
ReadX 12810 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12811
ReadX 12811 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12812
ReadX 12812 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12813
ReadX 12813 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12814
ReadX 12814 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12815
ReadX 12815 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12816
ReadX 12816 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12817
ReadX 12817 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12818
ReadX 12818 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12819
ReadX 12819 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12820
ReadX 12820 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12821
ReadX 12821 0 4096 4096
ReadX 12809 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12825
FIND_FIRST \clients\client1\~dmtmp\*
Close 12825
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12826
QUERY_FILE_INFORMATION 12826
WriteX 12826 2047 1 1
QUERY_FILE_INFORMATION 12826
WriteX 12826 0 2048 2048
Close 12826
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12827
ReadX 12827 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12827
Close 12809
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12828
ReadX 12828 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12829
FIND_FIRST \clients\client1\~dmtmp\*
Close 12829
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12830
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12830 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12831
ReadX 12831 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12832
ReadX 12832 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12833
ReadX 12833 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12834
ReadX 12834 0 543 543
ReadX 12830 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12838
FIND_FIRST \clients\client1\~dmtmp\*
Close 12838
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12839
QUERY_FILE_INFORMATION 12839
WriteX 12839 2047 1 1
QUERY_FILE_INFORMATION 12839
WriteX 12839 0 2048 2048
Close 12839
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12840
ReadX 12840 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12840
Close 12830
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12841
ReadX 12841 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 12814
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12842
FIND_FIRST \clients\client1\~dmtmp\*
Close 12842
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12843
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12843 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12844
ReadX 12844 0 4096 4096
ReadX 12843 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12848
FIND_FIRST \clients\client1\~dmtmp\*
Close 12848
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12849
QUERY_FILE_INFORMATION 12849
WriteX 12849 2047 1 1
QUERY_FILE_INFORMATION 12849
WriteX 12849 0 2048 2048
Close 12849
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12850
ReadX 12850 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12850
Close 12844
Close 12843
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12851
ReadX 12851 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12828 4095 1 1
QUERY_FILE_INFORMATION 12828
ReadX 12828 0 4096 4096
WriteX 12828 0 4096 4096
Flush 12828
WriteX 12841 4095 1 1
QUERY_FILE_INFORMATION 12841
ReadX 12841 0 4096 4096
WriteX 12841 0 4096 4096
Flush 12841
WriteX 12851 4095 1 1
QUERY_FILE_INFORMATION 12851
ReadX 12851 0 4096 4096
WriteX 12851 0 4096 4096
Flush 12851
WriteX 12828 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 12841 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 12851 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12852
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12852 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12853
ReadX 12853 0 4096 4096
ReadX 12852 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12854
ReadX 12854 0 4096 4096
ReadX 12854 0 4096 4096
ReadX 12854 4096 16384 16384
ReadX 12852 4096 16384 16384
ReadX 12852 0 4096 4096
ReadX 12853 0 4096 4096
ReadX 12853 4096 4096 4096
Close 12854
Close 12853
Close 12852
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12855
FIND_FIRST \clients\client1\~dmtmp\*
Close 12855
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12856
ReadX 12856 0 2048 2048
WriteX 12856 18431 1 1
QUERY_FILE_INFORMATION 12856
WriteX 12856 0 19584 19584
Close 12856
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12857
ReadX 12857 0 4096 4096
ReadX 12857 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12857
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12858
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12858 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12859
ReadX 12859 0 4096 4096
ReadX 12858 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12860
ReadX 12860 0 4096 4096
ReadX 12860 0 4096 4096
Close 12860
Close 12859
Close 12858
Close 12828
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12861
QUERY_FILE_INFORMATION 12861
Close 12861
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12834
Close 12821
Close 12813
Close 12831
Close 12832
Close 12833
Close 12820
Close 12815
Close 12818
Close 12819
Close 12816
Close 12817
Close 12810
Close 12811
Close 12812
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12841
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12862
QUERY_FILE_INFORMATION 12862
Close 12862
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12851
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12863
QUERY_FILE_INFORMATION 12863
Close 12863
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12864
FIND_FIRST \clients\client1\~dmtmp\*
Close 12864
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12865
ReadX 12865 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12866
ReadX 12866 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12867
ReadX 12867 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12868
ReadX 12868 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12869
ReadX 12869 0 543 543
ReadX 12865 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12865 4096 16384 16384
WriteX 12865 0 4096 4096
Close 12865
WriteX 12866 0 4096 4096
WriteX 12867 0 4096 4096
WriteX 12868 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12870
FIND_FIRST \clients\client1\~dmtmp\*
Close 12870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12871
ReadX 12871 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12872
ReadX 12872 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12873
ReadX 12873 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12874
ReadX 12874 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12875
ReadX 12875 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12876
ReadX 12876 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12877
ReadX 12877 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12878
ReadX 12878 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12879
ReadX 12879 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12880
ReadX 12880 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12881
ReadX 12881 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12882
ReadX 12882 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12883
ReadX 12883 0 4096 4096
ReadX 12871 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12884
ReadX 12884 0 8192 8192
ReadX 12871 4096 16384 16384
Close 12878
Close 12871
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12885
FIND_FIRST \clients\client1\~dmtmp\*
Close 12885
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12886
ReadX 12886 0 4096 4096
ReadX 12886 4096 4096 4096
ReadX 12886 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12887
ReadX 12887 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12888
ReadX 12888 0 4096 4096
ReadX 12887 0 4096 4096
ReadX 12887 0 4096 4096
ReadX 12887 4096 16384 16384
Close 12888
WriteX 12887 0 4096 4096
Close 12887
WriteX 12872 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12889
FIND_FIRST \clients\client1\~dmtmp\*
Close 12889
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12890
ReadX 12890 0 4096 4096
ReadX 12890 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12891
ReadX 12891 0 4096 4096
ReadX 12891 0 4096 4096
WriteX 12891 0 4096 4096
Close 12891
WriteX 12866 0 4096 4096
WriteX 12867 0 4096 4096
WriteX 12868 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12892
ReadX 12892 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12893
ReadX 12893 0 4096 4096
ReadX 12892 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12897
FIND_FIRST \clients\client1\~dmtmp\*
Close 12897
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12898
QUERY_FILE_INFORMATION 12898
WriteX 12898 2047 1 1
QUERY_FILE_INFORMATION 12898
WriteX 12898 0 2048 2048
Close 12898
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12899
ReadX 12899 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12899 4095 1 1
QUERY_FILE_INFORMATION 12899
ReadX 12899 0 4096 4096
WriteX 12899 0 4096 4096
Close 12899
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12900
ReadX 12900 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12900 0 4096 4096
Close 12893
Close 12892
WriteX 12900 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12901
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12901 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12902
ReadX 12902 0 4096 4096
ReadX 12901 0 4096 4096
ReadX 12901 4096 16384 16384
Close 12902
Close 12901
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12903
FIND_FIRST \clients\client1\~dmtmp\*
Close 12903
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12904
ReadX 12904 0 4096 4096
ReadX 12904 4096 4096 4096
WriteX 12904 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12904 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12904
ReadX 12900 0 4096 4096
WriteX 12900 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12905
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12905 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12906
ReadX 12906 0 4096 4096
ReadX 12905 0 4096 4096
ReadX 12905 4096 16384 16384
Close 12906
Close 12905
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12907
FIND_FIRST \clients\client1\~dmtmp\*
Close 12907
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12908
ReadX 12908 0 4096 4096
ReadX 12908 4096 4096 4096
WriteX 12908 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12908 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12908
Close 12900
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12909
QUERY_FILE_INFORMATION 12909
Close 12909
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 12884
Close 12886
Close 12890
Close 12869
Close 12866
Close 12867
Close 12868
Close 12877
Close 12882
Close 12879
Close 12880
Close 12881
Close 12883
Close 12872
Close 12875
Close 12876
Close 12873
Close 12874
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12910
FIND_FIRST \clients\client1\~dmtmp\*
Close 12910
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12911
ReadX 12911 0 4096 4096
ReadX 12911 4096 4096 4096
ReadX 12911 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12912
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12912 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12913
ReadX 12913 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12914
ReadX 12914 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12915
ReadX 12915 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12916
ReadX 12916 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12917
ReadX 12917 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12918
ReadX 12918 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12919
ReadX 12919 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12920
ReadX 12920 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12921
ReadX 12921 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12922
ReadX 12922 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12923
ReadX 12923 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12924
ReadX 12924 0 4096 4096
ReadX 12912 0 4096 4096
ReadX 12912 0 4096 4096
ReadX 12912 4096 16384 16384
Close 12919
Close 12912
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12925
ReadX 12925 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12926
ReadX 12926 0 4096 4096
ReadX 12925 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12930
FIND_FIRST \clients\client1\~dmtmp\*
Close 12930
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12931
QUERY_FILE_INFORMATION 12931
WriteX 12931 2047 1 1
QUERY_FILE_INFORMATION 12931
WriteX 12931 0 2048 2048
Close 12931
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12932
ReadX 12932 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12932 4095 1 1
QUERY_FILE_INFORMATION 12932
ReadX 12932 0 4096 4096
WriteX 12932 0 4096 4096
Close 12932
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12933
ReadX 12933 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12933 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12937
Close 12937
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12938
QUERY_FILE_INFORMATION 12938
WriteX 12938 2047 1 1
QUERY_FILE_INFORMATION 12938
WriteX 12938 0 2048 2048
Close 12938
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12939
ReadX 12939 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12939 4095 1 1
QUERY_FILE_INFORMATION 12939
ReadX 12939 0 4096 4096
WriteX 12939 0 4096 4096
Close 12939
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12940
ReadX 12940 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12940 0 4096 4096
Close 12925
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12941
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12941 0 4096 4096
ReadX 12941 0 4096 4096
ReadX 12941 4096 16384 16384
Close 12941
Close 12933
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12942
QUERY_FILE_INFORMATION 12942
Close 12942
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12911
Close 12923
Close 12918
Close 12924
Close 12926
Close 12913
Close 12916
Close 12917
Close 12914
Close 12915
Close 12920
Close 12921
Close 12922
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12940
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12943
QUERY_FILE_INFORMATION 12943
Close 12943
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12944
ReadX 12944 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 12945
Close 12945
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 12946
WriteX 12946 63 1 1
QUERY_FILE_INFORMATION 12946
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12944 0 4096 4096
ReadX 12944 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12944 0 8192 8192
Flush 12944
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12944 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12944 0 8192 8192
Flush 12944
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12944 0 8192 8192
Flush 12944
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12944 0 8192 8192
Flush 12944
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12948
Close 12948
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12950
WriteX 12950 4065 1 1
QUERY_FILE_INFORMATION 12950
WriteX 12950 0 62591 62591
Close 12950
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12952
Close 12952
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12954
WriteX 12954 4094 1 1
QUERY_FILE_INFORMATION 12954
WriteX 12954 0 10845 10845
Close 12954
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12956
Close 12956
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12958
WriteX 12958 4081 1 1
QUERY_FILE_INFORMATION 12958
WriteX 12958 0 30118 30118
Close 12958
WriteX 12944 0 4096 4096
Close 12944
WriteX 12946 0 64 64
Close 12946
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12959
ReadX 12959 61440 4096 4096
ReadX 12959 126976 4096 4096
WriteX 12959 0 65471 65471
WriteX 12959 65471 65 65
WriteX 12959 65536 65471 65471
WriteX 12959 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12960
ReadX 12960 61440 4096 4096
ReadX 12960 126976 4096 4096
ReadX 12960 192512 4096 4096
ReadX 12960 258048 4096 4096
WriteX 12960 0 65471 65471
WriteX 12960 65471 65 65
WriteX 12960 65536 65471 65471
WriteX 12960 131007 65 65
WriteX 12960 131072 65471 65471
WriteX 12960 196543 65 65
WriteX 12960 196608 65471 65471
WriteX 12960 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12961
ReadX 12961 61440 4096 4096
ReadX 12961 126976 4096 4096
ReadX 12961 192512 4096 4096
ReadX 12961 258048 4096 4096
ReadX 12961 323584 4096 4096
ReadX 12961 389120 4096 4096
ReadX 12961 454656 4096 4096
ReadX 12961 520192 4096 4096
WriteX 12961 0 65471 65471
WriteX 12961 65471 65 65
WriteX 12961 65536 65471 65471
WriteX 12961 131007 65 65
WriteX 12961 131072 65471 65471
WriteX 12961 196543 65 65
WriteX 12961 196608 65471 65471
WriteX 12961 262079 65 65
WriteX 12961 262144 65471 65471
WriteX 12961 327615 65 65
WriteX 12961 327680 65471 65471
WriteX 12961 393151 65 65
WriteX 12961 393216 65471 65471
WriteX 12961 458687 65 65
WriteX 12961 458752 65471 65471
WriteX 12961 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12962
Close 12962
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12959
Close 12960
Close 12961
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12963
ReadX 12963 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12964
ReadX 12964 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 12965
ReadX 12965 0 4096 4096
ReadX 12965 4096 4096 4096
ReadX 12965 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12966
Close 12966
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12963
Close 12964
Close 12965
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12967
Close 12967
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12968
ReadX 12968 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12969
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 12969
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12970
Close 12970
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12971
ReadX 12971 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12972
Close 12972
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12968
Close 12971
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12973
Close 12973
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12974
ReadX 12974 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12975
ReadX 12975 0 8192 8192
ReadX 12975 8192 8192 8192
ReadX 12975 16384 8192 8192
ReadX 12975 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12977
Close 12977
Close 12974
Close 12975
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12979
WriteX 12979 8191 1 1
QUERY_FILE_INFORMATION 12979
WriteX 12979 0 10438 10438
Close 12979
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12980
Close 12980
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12981
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12982
Close 12982
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12983
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12984
Close 12984
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12985
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12986
FIND_FIRST \clients\client1\~dmtmp\*
Close 12986
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12987
Close 12987
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12988
ReadX 12988 0 4096 4096
Close 12988
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12989
ReadX 12989 0 8192 8192
Close 12989
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12990
ReadX 12990 0 8192 8192
ReadX 12990 8192 4096 4096
ReadX 12990 12288 8192 8192
ReadX 12990 20480 8192 8192
ReadX 12990 28672 8192 8192
ReadX 12990 36864 8192 8192
ReadX 12990 45056 8192 8192
ReadX 12990 53248 8192 8192
ReadX 12990 61440 8192 8192
ReadX 12990 69632 8192 8192
ReadX 12990 77824 8192 8192
ReadX 12990 86016 8192 8192
ReadX 12990 94208 8192 8192
ReadX 12990 102400 8192 8192
ReadX 12990 110592 8192 8192
ReadX 12990 118784 8192 8192
ReadX 12990 126976 8192 8192
ReadX 12990 135168 8192 8192
ReadX 12990 143360 8192 8192
ReadX 12990 151552 8192 8192
ReadX 12990 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 12991
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12991
Close 12990
Close 12981
Close 12983
Close 12985
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 12992
Close 12992
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12994
WriteX 12994 8191 1 1
QUERY_FILE_INFORMATION 12994
WriteX 12994 0 28489 28489
Close 12994
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12995
Close 12995
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12996
FIND_FIRST \clients\client1\~dmtmp\*
Close 12996
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12997
Close 12997
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12998
ReadX 12998 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12999
Close 12999
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12998
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13000
Close 13000
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13001
ReadX 13001 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13002
ReadX 13002 0 8192 8192
ReadX 13002 8192 8192 8192
ReadX 13002 16384 8192 8192
ReadX 13002 24576 8192 8192
ReadX 13002 32768 16384 16384
ReadX 13002 49152 8192 8192
ReadX 13002 57344 8192 8192
ReadX 13002 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13004
Close 13004
Close 13001
Close 13002
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13006
WriteX 13006 8191 1 1
QUERY_FILE_INFORMATION 13006
WriteX 13006 0 29253 29253
Close 13006
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13007
Close 13007
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13008
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13009
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13009
Close 13008
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13010
Close 13010
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13012
WriteX 13012 8191 1 1
QUERY_FILE_INFORMATION 13012
WriteX 13012 0 30183 30183
Close 13012
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13013
Close 13013
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13014
WriteX 13014 0 510 510
WriteX 13014 510 512 512
WriteX 13014 1022 510 510
WriteX 13014 1532 510 510
WriteX 13014 2042 168 168
Close 13014
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13015
Close 13015
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13016
ReadX 13016 0 4096 4096
WriteX 13016 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13017
ReadX 13017 0 65471 65471
ReadX 13017 65471 65 65
ReadX 13017 65536 65471 65471
ReadX 13017 131007 65 65
ReadX 13017 131072 65471 65471
ReadX 13017 196543 65 65
ReadX 13017 196608 65471 65471
ReadX 13017 262079 65 65
ReadX 13017 262144 65471 65471
ReadX 13017 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13018
ReadX 13018 0 65471 65471
ReadX 13018 65471 65 65
ReadX 13018 65536 65471 65471
ReadX 13018 131007 65 65
ReadX 13018 131072 65471 65471
ReadX 13018 196543 65 65
ReadX 13018 196608 65471 65471
ReadX 13018 262079 65 65
ReadX 13018 262144 65471 65471
ReadX 13018 327615 65 65
ReadX 13018 327680 65471 65471
ReadX 13018 393151 65 65
ReadX 13018 393216 65471 65471
ReadX 13018 458687 65 65
ReadX 13018 458752 65471 65471
ReadX 13018 524223 65 65
ReadX 13018 524288 65471 65471
ReadX 13018 589759 65 65
ReadX 13018 589824 65471 65471
ReadX 13018 655295 65 65
ReadX 13018 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13019
ReadX 13019 0 65471 65471
ReadX 13019 65471 65 65
ReadX 13019 65536 65471 65471
ReadX 13019 131007 65 65
ReadX 13019 131072 65471 65471
ReadX 13019 196543 65 65
ReadX 13019 196608 65471 65471
ReadX 13019 262079 65 65
ReadX 13019 262144 65471 65471
ReadX 13019 327615 65 65
ReadX 13019 327680 65471 65471
ReadX 13019 393151 65 65
ReadX 13019 393216 65471 65471
ReadX 13019 458687 65 65
ReadX 13019 458752 65471 65471
ReadX 13019 524223 65 65
ReadX 13019 524288 65471 65471
ReadX 13019 589759 65 65
ReadX 13019 589824 65471 65471
ReadX 13019 655295 65 65
ReadX 13019 655360 65471 65471
ReadX 13019 720831 65 65
ReadX 13019 720896 65471 65471
ReadX 13019 786367 65 65
ReadX 13019 786432 65471 65471
ReadX 13019 851903 65 65
ReadX 13019 851968 65471 65471
ReadX 13019 917439 65 65
ReadX 13019 917504 65471 65471
ReadX 13019 982975 65 65
ReadX 13019 983040 65471 65471
ReadX 13019 1048511 65 65
ReadX 13019 1048576 65471 65471
ReadX 13019 1114047 65 65
ReadX 13019 1114112 65471 65471
ReadX 13019 1179583 65 65
ReadX 13019 1179648 65471 65471
ReadX 13019 1245119 65 65
ReadX 13019 1245184 65471 65471
ReadX 13019 1310655 65 65
ReadX 13019 1310720 65471 65471
ReadX 13019 1376191 65 65
ReadX 13019 1376256 65471 65471
ReadX 13019 1441727 65 65
ReadX 13019 1441792 65471 65471
ReadX 13019 1507263 65 65
ReadX 13019 1507328 65471 65471
ReadX 13019 1572799 65 65
ReadX 13019 1572864 65471 65471
ReadX 13019 1638335 65 65
ReadX 13019 1638400 65471 65471
ReadX 13019 1703871 65 65
ReadX 13019 1703936 65471 65471
ReadX 13019 1769407 65 65
ReadX 13019 1769472 65471 65471
ReadX 13019 1834943 65 65
ReadX 13019 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13020
ReadX 13020 0 4096 4096
ReadX 13020 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13021
WriteX 13021 52 1 1
QUERY_FILE_INFORMATION 13021
WriteX 13021 0 53 53
Close 13021
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13022
Close 13022
Close 13016
Close 13017
Close 13018
Close 13019
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13020 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13023
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13020 0 4096 4096
ReadX 13020 4096 4096 4096
ReadX 13020 8192 4096 4096
ReadX 13020 12288 4096 4096
WriteX 13023 15359 1 1
QUERY_FILE_INFORMATION 13023
ReadX 13020 16384 4096 4096
ReadX 13020 20480 4096 4096
WriteX 13023 0 15360 15360
Close 13023
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13024
ReadX 13024 0 4096 4096
WriteX 13024 0 4096 4096
Close 13024
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13025
Close 13025
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13026
ReadX 13026 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13027
Close 13027
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13020
ReadX 13026 0 4096 4096
ReadX 13026 4096 4096 4096
ReadX 13026 8192 4096 4096
ReadX 13026 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13028
ReadX 13028 0 4096 4096
ReadX 13028 0 4096 4096
ReadX 13028 4096 4096 4096
ReadX 13028 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13029
ReadX 13029 0 4096 4096
ReadX 13029 4096 4096 4096
ReadX 13029 8192 4096 4096
Close 13028
Close 13029
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13030
WriteX 13030 15359 1 1
QUERY_FILE_INFORMATION 13030
WriteX 13030 0 15360 15360
Close 13030
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13031
ReadX 13031 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13026
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13032
Close 13032
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13033
ReadX 13033 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13034
Close 13034
WriteX 13031 0 4096 4096
Close 13031
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13035
Close 13035
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13036
ReadX 13036 0 4096 4096
ReadX 13036 0 4096 4096
ReadX 13036 4096 4096 4096
ReadX 13036 8192 4096 4096
ReadX 13036 12288 3072 3072
ReadX 13036 0 8192 8192
ReadX 13036 8192 4096 4096
ReadX 13036 12288 3072 3072
WriteX 13036 15469 1 1
QUERY_FILE_INFORMATION 13036
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13037
ReadX 13037 0 4096 4096
ReadX 13037 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13038
WriteX 13038 52 1 1
QUERY_FILE_INFORMATION 13038
WriteX 13038 0 53 53
Close 13038
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13039
Close 13039
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13037 0 8192 8192
ReadX 13037 8192 4096 4096
ReadX 13037 12288 4096 4096
WriteX 13040 12005 1 1
QUERY_FILE_INFORMATION 13040
WriteX 13040 0 12006 12006
Close 13040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13041
ReadX 13041 0 4096 4096
WriteX 13041 0 4096 4096
Close 13041
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13042
Close 13042
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13043
ReadX 13043 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13044
Close 13044
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13037
ReadX 13043 0 4096 4096
ReadX 13043 4096 4096 4096
ReadX 13043 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13045
WriteX 13045 11990 1 1
QUERY_FILE_INFORMATION 13045
WriteX 13045 0 11991 11991
Close 13045
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13046
ReadX 13046 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13043
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13047
Close 13047
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13048
ReadX 13048 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13049
Close 13049
WriteX 13046 0 4096 4096
Close 13046
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13050
Close 13050
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13051
ReadX 13051 0 4096 4096
ReadX 13051 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13052
Close 13052
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13051 0 8192 8192
ReadX 13051 8192 3799 3799
WriteX 13051 13247 1 1
QUERY_FILE_INFORMATION 13051
WriteX 13051 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13051 0 8192 8192
ReadX 13051 8192 4096 4096
Close 13033
WriteX 13036 0 19054 19054
Close 13036
WriteX 13051 0 12288 12288
Close 13051
Close 13048
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13053
Close 13053
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13054
Close 13054
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13055
ReadX 13055 61440 4096 4096
ReadX 13055 126976 4096 4096
WriteX 13055 0 65471 65471
WriteX 13055 65471 65 65
WriteX 13055 65536 65471 65471
WriteX 13055 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13056
ReadX 13056 61440 4096 4096
ReadX 13056 126976 4096 4096
ReadX 13056 192512 4096 4096
ReadX 13056 258048 4096 4096
WriteX 13056 0 65471 65471
WriteX 13056 65471 65 65
WriteX 13056 65536 65471 65471
WriteX 13056 131007 65 65
WriteX 13056 131072 65471 65471
WriteX 13056 196543 65 65
WriteX 13056 196608 65471 65471
WriteX 13056 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13057
ReadX 13057 61440 4096 4096
ReadX 13057 126976 4096 4096
ReadX 13057 192512 4096 4096
ReadX 13057 258048 4096 4096
ReadX 13057 323584 4096 4096
ReadX 13057 389120 4096 4096
ReadX 13057 454656 4096 4096
ReadX 13057 520192 4096 4096
WriteX 13057 0 65471 65471
WriteX 13057 65471 65 65
WriteX 13057 65536 65471 65471
WriteX 13057 131007 65 65
WriteX 13057 131072 65471 65471
WriteX 13057 196543 65 65
WriteX 13057 196608 65471 65471
WriteX 13057 262079 65 65
WriteX 13057 262144 65471 65471
WriteX 13057 327615 65 65
WriteX 13057 327680 65471 65471
WriteX 13057 393151 65 65
WriteX 13057 393216 65471 65471
WriteX 13057 458687 65 65
WriteX 13057 458752 65471 65471
WriteX 13057 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13058
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13058 0 4096 4096
Close 13058
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13059
ReadX 13059 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13059
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13060
ReadX 13060 0 4096 4096
ReadX 13060 4096 4096 4096
ReadX 13060 8192 4096 4096
ReadX 13060 12288 4096 4096
ReadX 13060 16384 4096 4096
ReadX 13060 20480 4096 4096
ReadX 13060 24576 4096 4096
ReadX 13060 28672 4096 4096
ReadX 13060 32768 4096 4096
ReadX 13060 36864 4096 4096
ReadX 13060 40960 4096 4096
ReadX 13060 45056 4096 4096
ReadX 13060 49152 4096 4096
ReadX 13060 53248 4096 4096
ReadX 13060 57344 4096 4096
ReadX 13060 61440 4096 4096
ReadX 13060 65536 4096 4096
ReadX 13060 69632 4096 4096
ReadX 13060 73728 4096 4096
WriteX 13060 0 4096 4096
Close 13060
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13061
Close 13061
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13062
ReadX 13062 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13063
Close 13063
Close 13055
Close 13056
Close 13057
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13062
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13065
WriteX 13065 4607 1 1
QUERY_FILE_INFORMATION 13065
WriteX 13065 0 65471 65471
WriteX 13065 65471 65 65
WriteX 13065 65536 19979 19979
Close 13065
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13066
ReadX 13066 0 4096 4096
WriteX 13066 0 4096 4096
Flush 13066
WriteX 13066 0 4096 4096
Flush 13066
QUERY_FILE_INFORMATION 13066
WriteX 13066 0 4096 4096
Flush 13066
WriteX 13066 0 4096 4096
Flush 13066
WriteX 13066 0 4096 4096
Flush 13066
WriteX 13066 0 4096 4096
Flush 13066
Close 13066
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13067
ReadX 13067 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13068
ReadX 13068 0 4096 4096
Close 13067
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13069
ReadX 13069 0 4096 4096
Close 13069
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13070
ReadX 13070 0 4096 4096
Close 13070
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13071
ReadX 13071 0 4096 4096
WriteX 13071 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13072
Close 13072
Close 13068
Close 13071
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13073
Close 13073
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13075
WriteX 13075 4607 1 1
QUERY_FILE_INFORMATION 13075
WriteX 13075 0 65471 65471
WriteX 13075 65471 65 65
WriteX 13075 65536 17654 17654
Close 13075
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13076
ReadX 13076 0 4096 4096
WriteX 13076 0 4096 4096
Flush 13076
WriteX 13076 0 4096 4096
Flush 13076
QUERY_FILE_INFORMATION 13076
WriteX 13076 0 4096 4096
Flush 13076
WriteX 13076 0 4096 4096
Flush 13076
WriteX 13076 0 4096 4096
Flush 13076
WriteX 13076 0 4096 4096
Flush 13076
Close 13076
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13077
Close 13077
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13078
ReadX 13078 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13079
Close 13079
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13080
ReadX 13080 0 4096 4096
ReadX 13080 4096 4096 4096
ReadX 13080 8192 4096 4096
ReadX 13080 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13080 16384 4096 4096
ReadX 13080 20480 4096 4096
ReadX 13080 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13078
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13081
ReadX 13081 0 4096 4096
Close 13081
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13082
ReadX 13082 0 4096 4096
Close 13082
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13083
ReadX 13083 0 4096 4096
WriteX 13083 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13084
Close 13084
Close 13083
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13085
Close 13085
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13087
WriteX 13087 4607 1 1
QUERY_FILE_INFORMATION 13087
WriteX 13087 0 65471 65471
WriteX 13087 65471 65 65
WriteX 13087 65536 19490 19490
Close 13087
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13088
ReadX 13088 0 4096 4096
WriteX 13088 0 4096 4096
Flush 13088
WriteX 13088 0 4096 4096
Flush 13088
QUERY_FILE_INFORMATION 13088
WriteX 13088 0 4096 4096
Flush 13088
WriteX 13088 0 4096 4096
Flush 13088
WriteX 13088 0 4096 4096
Flush 13088
WriteX 13088 0 4096 4096
Flush 13088
Close 13088
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13089
Close 13089
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13090
ReadX 13090 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13091
Close 13091
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13090
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13092
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13092 0 4096 4096
Close 13092
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13093
ReadX 13093 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13093
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13094
ReadX 13094 0 4096 4096
ReadX 13094 4096 4096 4096
ReadX 13094 8192 4096 4096
ReadX 13094 12288 4096 4096
ReadX 13094 16384 4096 4096
ReadX 13094 20480 4096 4096
ReadX 13094 24576 4096 4096
ReadX 13094 28672 4096 4096
ReadX 13094 32768 4096 4096
ReadX 13094 36864 4096 4096
ReadX 13094 40960 4096 4096
ReadX 13094 45056 4096 4096
ReadX 13094 49152 4096 4096
ReadX 13094 53248 4096 4096
ReadX 13094 57344 4096 4096
ReadX 13094 61440 4096 4096
ReadX 13094 65536 4096 4096
ReadX 13094 69632 4096 4096
ReadX 13094 73728 4096 4096
WriteX 13094 0 4096 4096
Close 13094
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13095
Close 13095
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13096
ReadX 13096 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13097
Close 13097
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13096
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13099
WriteX 13099 4607 1 1
QUERY_FILE_INFORMATION 13099
WriteX 13099 0 65471 65471
WriteX 13099 65471 65 65
WriteX 13099 65536 8866 8866
Close 13099
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13100
ReadX 13100 0 4096 4096
WriteX 13100 0 4096 4096
Flush 13100
WriteX 13100 0 4096 4096
Flush 13100
Close 13100
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13101
ReadX 13101 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13101
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13102
ReadX 13102 0 4096 4096
Close 13102
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13103
ReadX 13103 0 4096 4096
Close 13103
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13104
ReadX 13104 0 4096 4096
WriteX 13104 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13105
Close 13105
Close 13104
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13106
Close 13106
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13108
WriteX 13108 4607 1 1
QUERY_FILE_INFORMATION 13108
WriteX 13108 0 65471 65471
WriteX 13108 65471 65 65
WriteX 13108 65536 9298 9298
Close 13108
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13109
ReadX 13109 0 4096 4096
WriteX 13109 0 4096 4096
Flush 13109
WriteX 13109 0 4096 4096
Flush 13109
Close 13109
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13110
Close 13110
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13111
ReadX 13111 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13112
Close 13112
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13114
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13114 0 4096 4096
Close 13114
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13115
ReadX 13115 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13115 4096 4096 4096
ReadX 13115 8192 4096 4096
ReadX 13115 12288 4096 4096
ReadX 13115 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13111
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13116
ReadX 13116 0 4096 4096
Close 13116
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13117
ReadX 13117 0 4096 4096
Close 13117
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13118
ReadX 13118 0 4096 4096
WriteX 13118 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13119
Close 13119
Close 13115
Close 13118
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13120
Close 13120
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13122
WriteX 13122 4607 1 1
QUERY_FILE_INFORMATION 13122
WriteX 13122 0 65471 65471
WriteX 13122 65471 65 65
WriteX 13122 65536 11540 11540
Close 13122
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13123
ReadX 13123 0 4096 4096
WriteX 13123 0 4096 4096
Flush 13123
WriteX 13123 0 4096 4096
Flush 13123
Close 13123
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13124
Close 13124
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13125
ReadX 13125 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13126
Close 13126
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13125
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13127
ReadX 13127 0 65471 65471
ReadX 13127 65471 65 65
ReadX 13127 65536 65471 65471
ReadX 13127 131007 65 65
ReadX 13127 131072 65471 65471
ReadX 13127 196543 65 65
ReadX 13127 196608 65471 65471
ReadX 13127 262079 65 65
ReadX 13127 262144 65471 65471
ReadX 13127 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13128
ReadX 13128 0 65471 65471
ReadX 13128 65471 65 65
ReadX 13128 65536 65471 65471
ReadX 13128 131007 65 65
ReadX 13128 131072 65471 65471
ReadX 13128 196543 65 65
ReadX 13128 196608 65471 65471
ReadX 13128 262079 65 65
ReadX 13128 262144 65471 65471
ReadX 13128 327615 65 65
ReadX 13128 327680 65471 65471
ReadX 13128 393151 65 65
ReadX 13128 393216 65471 65471
ReadX 13128 458687 65 65
ReadX 13128 458752 65471 65471
ReadX 13128 524223 65 65
ReadX 13128 524288 65471 65471
ReadX 13128 589759 65 65
ReadX 13128 589824 65471 65471
ReadX 13128 655295 65 65
ReadX 13128 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13129
ReadX 13129 0 65471 65471
ReadX 13129 65471 65 65
ReadX 13129 65536 65471 65471
ReadX 13129 131007 65 65
ReadX 13129 131072 65471 65471
ReadX 13129 196543 65 65
ReadX 13129 196608 65471 65471
ReadX 13129 262079 65 65
ReadX 13129 262144 65471 65471
ReadX 13129 327615 65 65
ReadX 13129 327680 65471 65471
ReadX 13129 393151 65 65
ReadX 13129 393216 65471 65471
ReadX 13129 458687 65 65
ReadX 13129 458752 65471 65471
ReadX 13129 524223 65 65
ReadX 13129 524288 65471 65471
ReadX 13129 589759 65 65
ReadX 13129 589824 65471 65471
ReadX 13129 655295 65 65
ReadX 13129 655360 65471 65471
ReadX 13129 720831 65 65
ReadX 13129 720896 65471 65471
ReadX 13129 786367 65 65
ReadX 13129 786432 65471 65471
ReadX 13129 851903 65 65
ReadX 13129 851968 65471 65471
ReadX 13129 917439 65 65
ReadX 13129 917504 65471 65471
ReadX 13129 982975 65 65
ReadX 13129 983040 65471 65471
ReadX 13129 1048511 65 65
ReadX 13129 1048576 65471 65471
ReadX 13129 1114047 65 65
ReadX 13129 1114112 65471 65471
ReadX 13129 1179583 65 65
ReadX 13129 1179648 65471 65471
ReadX 13129 1245119 65 65
ReadX 13129 1245184 65471 65471
ReadX 13129 1310655 65 65
ReadX 13129 1310720 65471 65471
ReadX 13129 1376191 65 65
ReadX 13129 1376256 65471 65471
ReadX 13129 1441727 65 65
ReadX 13129 1441792 65471 65471
ReadX 13129 1507263 65 65
ReadX 13129 1507328 65471 65471
ReadX 13129 1572799 65 65
ReadX 13129 1572864 65471 65471
ReadX 13129 1638335 65 65
ReadX 13129 1638400 65471 65471
ReadX 13129 1703871 65 65
ReadX 13129 1703936 65471 65471
ReadX 13129 1769407 65 65
ReadX 13129 1769472 65471 65471
ReadX 13129 1834943 65 65
ReadX 13129 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13130
FIND_FIRST \clients\client1\~dmtmp\*
Close 13130
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13131
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13132
QUERY_FILE_INFORMATION 13132
QUERY_FILE_INFORMATION 13132
QUERY_FILE_INFORMATION 13132
ReadX 13132 2156 24 24
ReadX 13132 2139 276 276
ReadX 13132 2136 14 14
ReadX 13132 2136 7 7
ReadX 13132 2138 12 12
ReadX 13132 2137 8 8
ReadX 13132 2135 15 15
ReadX 13132 0 16 16
ReadX 13132 16 2048 2048
ReadX 13132 2064 2048 2048
ReadX 13132 257 2048 2048
ReadX 13132 385 2048 2048
ReadX 13132 513 2048 2048
ReadX 13132 641 2048 2048
ReadX 13132 769 2048 2048
ReadX 13132 897 2048 2048
ReadX 13132 1025 2048 2048
ReadX 13132 1153 2048 2048
ReadX 13132 1281 2048 2048
ReadX 13132 1409 2048 2048
ReadX 13132 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13134
Close 13134
Close 13080
Close 13127
Close 13128
Close 13129
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13136
WriteX 13136 15 1 1
QUERY_FILE_INFORMATION 13136
WriteX 13136 0 10575 10575
Flush 13136
Close 13136
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13137
Close 13137
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13138
ReadX 13138 0 4096 4096
Close 13132
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13139
Close 13139
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13140
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13141
QUERY_FILE_INFORMATION 13141
ReadX 13141 0 512 512
ReadX 13141 512 512 512
ReadX 13141 1024 512 512
QUERY_FILE_INFORMATION 13141
QUERY_FILE_INFORMATION 13141
Close 13141
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13142
QUERY_FILE_INFORMATION 13142
ReadX 13142 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13143
QUERY_FILE_INFORMATION 13143
ReadX 13143 0 512 512
ReadX 13143 512 512 512
ReadX 13143 1024 512 512
ReadX 13143 288 20 20
ReadX 13143 308 2084 2084
ReadX 13143 388 2084 2084
ReadX 13143 388 2084 2084
ReadX 13131 2157 1386 1386
ReadX 13143 2472 399 399
ReadX 13143 3072 1536 1536
ReadX 13143 544 149 149
ReadX 13143 693 485 485
Close 13143
ReadX 13131 2157 4096 4096
ReadX 13131 6253 4096 4096
ReadX 13131 10349 4096 4096
ReadX 13131 14445 4096 4096
ReadX 13131 18541 4096 4096
ReadX 13131 22637 256 256
ReadX 13131 22893 4096 4096
ReadX 13131 26989 4096 4096
ReadX 13131 31085 4096 4096
ReadX 13131 35181 4096 4096
ReadX 13131 39277 4096 4096
ReadX 13131 43373 4096 4096
ReadX 13131 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13131 2157 1024 1024
ReadX 13131 1667 4688 4688
ReadX 13131 6355 3516 3516
ReadX 13131 9871 16384 16384
ReadX 13131 26255 3771 3771
ReadX 13131 30026 2048 2048
ReadX 13131 32074 1024 1024
ReadX 13131 33098 6652 6652
ReadX 13131 39750 16384 16384
ReadX 13131 56134 10496 10496
ReadX 13131 66630 1784 1784
ReadX 13131 68414 90 90
ReadX 13131 68504 273 273
ReadX 13131 68777 1600 1600
ReadX 13131 70377 640 640
ReadX 13131 71017 1280 1280
ReadX 13131 72297 8464 8464
ReadX 13131 80761 158 158
ReadX 13131 80919 912 912
ReadX 13131 81831 1980 1980
ReadX 13131 83811 2256 2256
ReadX 13131 86067 400 400
ReadX 13131 86467 252 252
ReadX 13131 86719 42 42
ReadX 13131 86761 725 725
ReadX 13131 2009 512 512
ReadX 13131 3895 9 9
ReadX 13131 3781 46 46
ReadX 13131 4059 92 92
ReadX 13131 3781 92 92
ReadX 13131 3986 184 184
ReadX 13131 3987 16384 16384
ReadX 13131 3902 16384 16384
ReadX 13131 3781 10240 10240
ReadX 13131 3821 16384 16384
ReadX 13131 3891 935 935
ReadX 13131 4060 10240 10240
ReadX 13131 4059 184 184
ReadX 13131 256 184 184
ReadX 13131 256 1026 1026
ReadX 13131 3901 326 326
ReadX 13131 3899 652 652
ReadX 13131 256 2 2
ReadX 13131 258 4948 4948
Close 13131
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13145
Close 13145
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13147
WriteX 13147 4055 1 1
QUERY_FILE_INFORMATION 13147
WriteX 13147 0 65471 65471
WriteX 13147 65471 65 65
WriteX 13147 65536 65471 65471
WriteX 13147 131007 65 65
WriteX 13147 131072 65471 65471
WriteX 13147 196543 65 65
WriteX 13147 196608 65471 65471
WriteX 13147 262079 65 65
WriteX 13147 262144 65471 65471
WriteX 13147 327615 65 65
WriteX 13147 327680 65471 65471
WriteX 13147 393151 65 65
WriteX 13147 393216 65471 65471
WriteX 13147 458687 65 65
WriteX 13147 458752 65471 65471
WriteX 13147 524223 65 65
WriteX 13147 524288 65471 65471
WriteX 13147 589759 65 65
WriteX 13147 589824 35257 35257
Close 13147
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13149
Close 13149
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13151
WriteX 13151 4055 1 1
QUERY_FILE_INFORMATION 13151
WriteX 13151 0 65471 65471
WriteX 13151 65471 65 65
WriteX 13151 65536 65471 65471
WriteX 13151 131007 65 65
WriteX 13151 131072 65471 65471
WriteX 13151 196543 65 65
WriteX 13151 196608 65471 65471
WriteX 13151 262079 65 65
WriteX 13151 262144 65471 65471
WriteX 13151 327615 65 65
WriteX 13151 327680 65471 65471
WriteX 13151 393151 65 65
WriteX 13151 393216 65471 65471
WriteX 13151 458687 65 65
WriteX 13151 458752 65471 65471
WriteX 13151 524223 65 65
WriteX 13151 524288 65471 65471
WriteX 13151 589759 65 65
WriteX 13151 589824 57598 57598
Close 13151
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13153
WriteX 13153 15 1 1
QUERY_FILE_INFORMATION 13153
WriteX 13153 0 12543 12543
Flush 13153
Close 13153
Close 13138
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13154
Close 13154
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13155
ReadX 13155 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13156
FIND_FIRST \clients\client1\~dmtmp\*
Close 13156
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13157
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13158
QUERY_FILE_INFORMATION 13158
QUERY_FILE_INFORMATION 13158
QUERY_FILE_INFORMATION 13158
ReadX 13158 1938 24 24
ReadX 13158 1920 276 276
ReadX 13158 1918 14 14
ReadX 13158 1918 7 7
ReadX 13158 1919 12 12
ReadX 13158 1919 8 8
ReadX 13158 1917 15 15
ReadX 13158 0 16 16
ReadX 13158 16 2048 2048
ReadX 13158 2064 2048 2048
ReadX 13158 257 2048 2048
ReadX 13158 385 2048 2048
ReadX 13158 513 2048 2048
ReadX 13158 641 2048 2048
ReadX 13158 769 2048 2048
ReadX 13158 897 2048 2048
ReadX 13158 1025 2048 2048
ReadX 13158 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13160
Close 13160
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13162
WriteX 13162 15 1 1
QUERY_FILE_INFORMATION 13162
WriteX 13162 0 11588 11588
Flush 13162
Close 13162
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13163
Close 13163
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13164
ReadX 13164 0 4096 4096
Close 13158
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13166
WriteX 13166 15 1 1
QUERY_FILE_INFORMATION 13166
WriteX 13166 0 11615 11615
Flush 13166
Close 13166
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13164
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13167
Close 13167
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13168
ReadX 13168 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13170
Close 13170
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13172
WriteX 13172 4088 1 1
QUERY_FILE_INFORMATION 13172
WriteX 13172 0 65471 65471
WriteX 13172 65471 65 65
WriteX 13172 65536 16050 16050
Close 13172
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13157 1939 64 64
ReadX 13157 128 248 248
ReadX 13157 128 568 568
ReadX 13157 3872 1536 1536
ReadX 13157 3456 2560 2560
ReadX 13157 3136 512 512
ReadX 13157 2880 4096 4096
ReadX 13157 3264 3072 3072
ReadX 13157 320 4096 4096
ReadX 13157 1024 4096 4096
ReadX 13157 3616 4096 4096
ReadX 13157 1939 64 64
ReadX 13157 128 248 248
ReadX 13157 128 608 608
ReadX 13157 2858 1024 1024
ReadX 13157 2810 4096 4096
ReadX 13157 2826 4096 4096
ReadX 13157 2580 2048 2048
ReadX 13157 2800 2560 2560
ReadX 13157 2100 4096 4096
ReadX 13157 2084 4096 4096
ReadX 13157 868 4096 4096
ReadX 13157 2324 4096 4096
ReadX 13157 884 4096 4096
ReadX 13157 2604 1024 1024
ReadX 13157 580 4096 4096
ReadX 13157 596 4096 4096
ReadX 13157 2752 4096 4096
ReadX 13157 2842 1024 1024
ReadX 13157 660 4096 4096
ReadX 13157 2720 4096 4096
ReadX 13157 2736 4096 4096
ReadX 13157 628 4096 4096
ReadX 13157 2704 4096 4096
ReadX 13157 1556 4096 4096
ReadX 13157 576 4096 4096
ReadX 13157 3168 1536 1536
ReadX 13157 832 4096 4096
ReadX 13157 1088 4096 4096
ReadX 13157 1344 4096 4096
ReadX 13157 1600 4096 4096
ReadX 13157 1856 4096 4096
ReadX 13157 2112 4096 4096
ReadX 13157 1892 4096 4096
ReadX 13157 820 4096 4096
ReadX 13157 788 4096 4096
ReadX 13157 1604 4096 4096
ReadX 13157 3648 4096 4096
ReadX 13157 2608 4096 4096
ReadX 13157 548 4096 4096
ReadX 13157 740 4096 4096
ReadX 13157 1344 4096 4096
ReadX 13157 3392 4096 4096
ReadX 13157 3904 4096 4096
ReadX 13157 644 4096 4096
ReadX 13157 676 4096 4096
ReadX 13157 2688 4096 4096
ReadX 13157 320 4096 4096
ReadX 13157 900 4096 4096
ReadX 13157 1908 4096 4096
ReadX 13157 852 4096 4096
ReadX 13157 724 4096 4096
ReadX 13157 2292 4096 4096
ReadX 13157 612 4096 4096
ReadX 13157 388 4096 4096
ReadX 13157 2368 4096 4096
ReadX 13157 2624 4096 4096
ReadX 13157 500 4096 4096
ReadX 13157 356 4096 4096
ReadX 13157 1024 4096 4096
ReadX 13157 576 4096 4096
ReadX 13157 340 4096 4096
ReadX 13157 420 4096 4096
ReadX 13157 1600 4096 4096
ReadX 13157 404 4096 4096
ReadX 13157 1428 4096 4096
ReadX 13157 2656 4096 4096
ReadX 13157 2624 4096 4096
ReadX 13157 452 4096 4096
ReadX 13157 692 4096 4096
ReadX 13157 564 4096 4096
ReadX 13157 372 4096 4096
ReadX 13157 468 4096 4096
ReadX 13157 484 4096 4096
ReadX 13157 1088 4096 4096
ReadX 13157 1924 4096 4096
ReadX 13157 2768 4096 4096
ReadX 13157 832 4096 4096
ReadX 13157 836 4096 4096
ReadX 13157 1856 4096 4096
ReadX 13157 2640 4096 4096
ReadX 13157 436 4096 4096
ReadX 13157 1828 4096 4096
ReadX 13157 804 4096 4096
ReadX 13157 1860 4096 4096
ReadX 13157 1812 4096 4096
ReadX 13157 756 4096 4096
ReadX 13157 1636 4096 4096
ReadX 13157 772 4096 4096
ReadX 13157 2036 4096 4096
ReadX 13157 1220 4096 4096
ReadX 13157 1652 4096 4096
ReadX 13157 2588 4096 4096
ReadX 13157 916 4096 4096
ReadX 13157 260 4096 4096
ReadX 13157 932 4096 4096
ReadX 13157 2624 4096 4096
ReadX 13157 308 4096 4096
ReadX 13157 292 4096 4096
ReadX 13157 1140 4096 4096
ReadX 13157 276 4096 4096
ReadX 13157 2020 4096 4096
ReadX 13157 2880 4096 4096
ReadX 13157 516 4096 4096
ReadX 13157 1844 4096 4096
ReadX 13157 1124 4096 4096
ReadX 13157 3136 4096 4096
ReadX 13157 324 4096 4096
ReadX 13157 1156 4096 4096
ReadX 13157 1172 4096 4096
ReadX 13157 2112 4096 4096
ReadX 13157 2368 4096 4096
ReadX 13157 964 4096 4096
ReadX 13157 980 4096 4096
ReadX 13157 1012 4096 4096
ReadX 13157 532 4096 4096
ReadX 13157 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13157 1620 4096 4096
ReadX 13157 1604 4096 4096
ReadX 13157 2116 4096 4096
ReadX 13157 2132 4096 4096
ReadX 13157 2148 4096 4096
ReadX 13157 2276 4096 4096
ReadX 13157 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13174
Close 13174
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13176
QUERY_FILE_INFORMATION 13140
Close 13140
WriteX 13176 4088 1 1
QUERY_FILE_INFORMATION 13176
QUERY_FILE_INFORMATION 13142
Close 13142
WriteX 13176 0 65471 65471
WriteX 13176 65471 65 65
WriteX 13176 65536 64850 64850
Close 13176
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13178
WriteX 13178 15 1 1
QUERY_FILE_INFORMATION 13178
ReadX 13157 2068 4096 4096
ReadX 13157 1588 4096 4096
ReadX 13157 1572 4096 4096
WriteX 13178 0 18630 18630
Flush 13178
Close 13178
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13168
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13179
Close 13179
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13180
ReadX 13180 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13157 612 4096 4096
ReadX 13157 564 4096 4096
ReadX 13157 1876 4096 4096
ReadX 13157 628 4096 4096
ReadX 13157 740 4096 4096
ReadX 13157 724 4096 4096
ReadX 13157 644 4096 4096
ReadX 13157 2324 4096 4096
ReadX 13157 660 4096 4096
ReadX 13157 852 4096 4096
ReadX 13157 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13157 2368 4096 4096
ReadX 13157 1024 4096 4096
ReadX 13157 320 4096 4096
ReadX 13157 580 4096 4096
ReadX 13157 3136 512 512
ReadX 13157 2880 4096 4096
Close 13157
Close 13180
Close 13155
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13181
ReadX 13181 61440 4096 4096
ReadX 13181 126976 4096 4096
WriteX 13181 0 65471 65471
WriteX 13181 65471 65 65
WriteX 13181 65536 65471 65471
WriteX 13181 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13182
ReadX 13182 61440 4096 4096
ReadX 13182 126976 4096 4096
ReadX 13182 192512 4096 4096
ReadX 13182 258048 4096 4096
WriteX 13182 0 65471 65471
WriteX 13182 65471 65 65
WriteX 13182 65536 65471 65471
WriteX 13182 131007 65 65
WriteX 13182 131072 65471 65471
WriteX 13182 196543 65 65
WriteX 13182 196608 65471 65471
WriteX 13182 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13183
ReadX 13183 61440 4096 4096
ReadX 13183 126976 4096 4096
ReadX 13183 192512 4096 4096
ReadX 13183 258048 4096 4096
ReadX 13183 323584 4096 4096
ReadX 13183 389120 4096 4096
ReadX 13183 454656 4096 4096
ReadX 13183 520192 4096 4096
WriteX 13183 0 65471 65471
WriteX 13183 65471 65 65
WriteX 13183 65536 65471 65471
WriteX 13183 131007 65 65
WriteX 13183 131072 65471 65471
WriteX 13183 196543 65 65
WriteX 13183 196608 65471 65471
WriteX 13183 262079 65 65
WriteX 13183 262144 65471 65471
WriteX 13183 327615 65 65
WriteX 13183 327680 65471 65471
WriteX 13183 393151 65 65
WriteX 13183 393216 65471 65471
WriteX 13183 458687 65 65
WriteX 13183 458752 65471 65471
WriteX 13183 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13184
Close 13184
Close 13181
Close 13182
Close 13183
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13185
Close 13185
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13188
Close 13188
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13190
Close 13190
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13191
Close 13191
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13194
Close 13194
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13196
Close 13196
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13197
Close 13197
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13200
Close 13200
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13204
Close 13204
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13208
Close 13208
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13212
Close 13212
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13216
Close 13216
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13220
Close 13220
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13224
Close 13224
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13228
Close 13228
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13230
Close 13230
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13232
Close 13232
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13234
WriteX 13234 4095 1 1
QUERY_FILE_INFORMATION 13234
QUERY_FS_INFORMATION 259
WriteX 13234 0 65471 65471
WriteX 13234 65471 65 65
WriteX 13234 65536 65471 65471
WriteX 13234 131007 65 65
WriteX 13234 131072 65471 65471
WriteX 13234 196543 65 65
WriteX 13234 196608 65471 65471
WriteX 13234 262079 65 65
WriteX 13234 262144 26634 26634
Close 13234
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13239
Close 13239
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13240
Close 13240
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13241
ReadX 13241 0 4096 4096
Close 13241
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13242
ReadX 13242 0 4096 4096
ReadX 13242 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13243
Close 13243
Close 13242
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13246
Close 13246
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13248
Close 13248
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13249
Close 13249
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13252
Close 13252
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13254
Close 13254
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13255
Close 13255
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13258
Close 13258
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13262
Close 13262
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13266
Close 13266
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13270
Close 13270
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13274
Close 13274
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13278
Close 13278
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13281
Close 13281
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13285
Close 13285
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13289
Close 13289
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13291
Close 13291
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13292
Close 13292
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13301
Close 13301
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13302
FIND_FIRST \clients\client1\~dmtmp\*
Close 13302
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13303
Close 13303
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13304
ReadX 13304 0 4096 4096
Close 13304
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13305
ReadX 13305 0 4096 4096
Close 13305
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13306
ReadX 13306 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13316
Close 13316
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13317
FIND_FIRST \clients\client1\~dmtmp\*
Close 13317
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13318
Close 13318
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13319
ReadX 13319 0 4096 4096
Close 13319
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13320
ReadX 13320 0 4096 4096
Close 13320
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13321
ReadX 13321 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13322
ReadX 13322 0 65471 65471
ReadX 13322 65471 65 65
ReadX 13322 65536 65471 65471
ReadX 13322 131007 65 65
ReadX 13322 131072 65471 65471
ReadX 13322 196543 65 65
ReadX 13322 196608 65471 65471
ReadX 13322 262079 65 65
ReadX 13322 262144 65471 65471
ReadX 13322 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13323
ReadX 13323 0 65471 65471
ReadX 13323 65471 65 65
ReadX 13323 65536 65471 65471
ReadX 13323 131007 65 65
ReadX 13323 131072 65471 65471
ReadX 13323 196543 65 65
ReadX 13323 196608 65471 65471
ReadX 13323 262079 65 65
ReadX 13323 262144 65471 65471
ReadX 13323 327615 65 65
ReadX 13323 327680 65471 65471
ReadX 13323 393151 65 65
ReadX 13323 393216 65471 65471
ReadX 13323 458687 65 65
ReadX 13323 458752 65471 65471
ReadX 13323 524223 65 65
ReadX 13323 524288 65471 65471
ReadX 13323 589759 65 65
ReadX 13323 589824 65471 65471
ReadX 13323 655295 65 65
ReadX 13323 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13324
ReadX 13324 0 65471 65471
ReadX 13324 65471 65 65
ReadX 13324 65536 65471 65471
ReadX 13324 131007 65 65
ReadX 13324 131072 65471 65471
ReadX 13324 196543 65 65
ReadX 13324 196608 65471 65471
ReadX 13324 262079 65 65
ReadX 13324 262144 65471 65471
ReadX 13324 327615 65 65
ReadX 13324 327680 65471 65471
ReadX 13324 393151 65 65
ReadX 13324 393216 65471 65471
ReadX 13324 458687 65 65
ReadX 13324 458752 65471 65471
ReadX 13324 524223 65 65
ReadX 13324 524288 65471 65471
ReadX 13324 589759 65 65
ReadX 13324 589824 65471 65471
ReadX 13324 655295 65 65
ReadX 13324 655360 65471 65471
ReadX 13324 720831 65 65
ReadX 13324 720896 65471 65471
ReadX 13324 786367 65 65
ReadX 13324 786432 65471 65471
ReadX 13324 851903 65 65
ReadX 13324 851968 65471 65471
ReadX 13324 917439 65 65
ReadX 13324 917504 65471 65471
ReadX 13324 982975 65 65
ReadX 13324 983040 65471 65471
ReadX 13324 1048511 65 65
ReadX 13324 1048576 65471 65471
ReadX 13324 1114047 65 65
ReadX 13324 1114112 65471 65471
ReadX 13324 1179583 65 65
ReadX 13324 1179648 65471 65471
ReadX 13324 1245119 65 65
ReadX 13324 1245184 65471 65471
ReadX 13324 1310655 65 65
ReadX 13324 1310720 65471 65471
ReadX 13324 1376191 65 65
ReadX 13324 1376256 65471 65471
ReadX 13324 1441727 65 65
ReadX 13324 1441792 65471 65471
ReadX 13324 1507263 65 65
ReadX 13324 1507328 65471 65471
ReadX 13324 1572799 65 65
ReadX 13324 1572864 65471 65471
ReadX 13324 1638335 65 65
ReadX 13324 1638400 65471 65471
ReadX 13324 1703871 65 65
ReadX 13324 1703936 65471 65471
ReadX 13324 1769407 65 65
ReadX 13324 1769472 65471 65471
ReadX 13324 1834943 65 65
ReadX 13324 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13325
ReadX 13325 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13325 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13325 8192 4096 4096
ReadX 13325 12288 4096 4096
ReadX 13325 16384 4096 4096
ReadX 13325 20480 4096 4096
ReadX 13325 24576 4096 4096
ReadX 13325 28672 4096 4096
ReadX 13325 32768 4096 4096
ReadX 13325 36864 4096 4096
ReadX 13325 40960 4096 4096
ReadX 13325 45056 4096 4096
ReadX 13325 49152 4096 4096
ReadX 13325 53248 4096 4096
ReadX 13325 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13325 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13326
Close 13326
Close 13306
Close 13321
Close 13322
Close 13323
Close 13324
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13327
WriteX 13327 1535 1 1
QUERY_FILE_INFORMATION 13327
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13325 0 4096 4096
ReadX 13325 4096 4096 4096
QUERY_FILE_INFORMATION 13327
WriteX 13327 0 57088 57088
WriteX 13327 0 4096 4096
Flush 13327
Close 13325
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13328
Close 13328
WriteX 13327 0 4096 4096
Close 13327
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13329
Close 13329
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13330
ReadX 13330 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13330 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13331
WriteX 13331 1535 1 1
QUERY_FILE_INFORMATION 13331
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13330 0 4096 4096
QUERY_FILE_INFORMATION 13331
WriteX 13331 0 51456 51456
WriteX 13331 0 4096 4096
Flush 13331
Close 13330
WriteX 13331 0 4096 4096
Close 13331
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13332
Close 13332
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13333
ReadX 13333 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13333 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13335
Close 13335
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13337
WriteX 13337 4045 1 1
QUERY_FILE_INFORMATION 13337
WriteX 13337 0 53077 53077
Close 13337
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13338
WriteX 13338 1535 1 1
QUERY_FILE_INFORMATION 13338
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13333 0 4096 4096
QUERY_FILE_INFORMATION 13338
WriteX 13338 0 65471 65471
WriteX 13338 65471 65 65
WriteX 13338 65536 1856 1856
WriteX 13338 0 4096 4096
Flush 13338
Close 13333
WriteX 13338 0 4096 4096
Close 13338
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13339
Close 13339
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13340
ReadX 13340 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13342
Close 13342
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13344
WriteX 13344 4076 1 1
QUERY_FILE_INFORMATION 13344
WriteX 13344 0 7983 7983
Close 13344
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13346
Close 13346
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13348
WriteX 13348 4095 1 1
QUERY_FILE_INFORMATION 13348
WriteX 13348 0 65471 65471
WriteX 13348 65471 65 65
WriteX 13348 65536 65471 65471
WriteX 13348 131007 65 65
WriteX 13348 131072 65471 65471
WriteX 13348 196543 65 65
WriteX 13348 196608 65471 65471
WriteX 13348 262079 65 65
WriteX 13348 262144 65471 65471
WriteX 13348 327615 65 65
WriteX 13348 327680 65471 65471
WriteX 13348 393151 65 65
WriteX 13348 393216 65471 65471
WriteX 13348 458687 65 65
WriteX 13348 458752 46731 46731
Close 13348
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13349
WriteX 13349 1535 1 1
QUERY_FILE_INFORMATION 13349
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13340 0 4096 4096
ReadX 13340 4096 4096 4096
QUERY_FILE_INFORMATION 13349
WriteX 13349 0 65471 65471
WriteX 13349 65471 65 65
WriteX 13349 65536 22848 22848
WriteX 13349 0 4096 4096
Flush 13349
Close 13340
WriteX 13349 0 4096 4096
Close 13349
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13350
Close 13350
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13351
ReadX 13351 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13351 4096 4096 4096
Close 13351
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13352
ReadX 13352 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13352 0 8192 8192
ReadX 13352 8192 4096 4096
ReadX 13352 12288 4096 4096
ReadX 13352 16384 4096 4096
ReadX 13352 20480 4096 4096
ReadX 13352 24576 4096 4096
ReadX 13352 28672 4096 4096
ReadX 13352 32768 4096 4096
ReadX 13352 36864 4096 4096
ReadX 13352 40960 4096 4096
ReadX 13352 45056 4096 4096
ReadX 13352 49152 4096 4096
ReadX 13352 53248 4096 4096
ReadX 13352 57344 4096 4096
ReadX 13352 61440 4096 4096
ReadX 13352 65536 4096 4096
ReadX 13352 69632 4096 4096
ReadX 13352 73728 4096 4096
ReadX 13352 77824 4096 4096
ReadX 13352 81920 4096 4096
ReadX 13352 86016 4096 4096
ReadX 13352 90112 4096 4096
ReadX 13352 94208 4096 4096
ReadX 13352 98304 4096 4096
ReadX 13352 102400 4096 4096
ReadX 13352 106496 4096 4096
ReadX 13352 110592 4096 4096
ReadX 13352 114688 4096 4096
ReadX 13352 118784 4096 4096
ReadX 13352 122880 4096 4096
ReadX 13352 126976 4096 4096
ReadX 13352 131072 4096 4096
ReadX 13352 135168 4096 4096
ReadX 13352 139264 4096 4096
ReadX 13352 143360 4096 4096
ReadX 13352 147456 4096 4096
ReadX 13352 151552 4096 4096
ReadX 13352 155648 4096 4096
ReadX 13352 159744 4096 4096
ReadX 13352 163840 4096 4096
ReadX 13352 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13352 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13353
Close 13353
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13354
WriteX 13354 2047 1 1
QUERY_FILE_INFORMATION 13354
Close 13352
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13355
Close 13355
WriteX 13354 0 42388 42388
Close 13354
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13356
Close 13356
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13357
ReadX 13357 0 4096 4096
ReadX 13357 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13358
WriteX 13358 2047 1 1
QUERY_FILE_INFORMATION 13358
Close 13357
WriteX 13358 0 42652 42652
Close 13358
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13359
Close 13359
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13360
ReadX 13360 0 4096 4096
ReadX 13360 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13362
Close 13362
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13364
WriteX 13364 4080 1 1
QUERY_FILE_INFORMATION 13364
WriteX 13364 0 65471 65471
WriteX 13364 65471 65 65
WriteX 13364 65536 49 49
Close 13364
Close 13360
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13365
ReadX 13365 61440 4096 4096
ReadX 13365 126976 4096 4096
WriteX 13365 0 65471 65471
WriteX 13365 65471 65 65
WriteX 13365 65536 65471 65471
WriteX 13365 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13366
ReadX 13366 61440 4096 4096
ReadX 13366 126976 4096 4096
ReadX 13366 192512 4096 4096
ReadX 13366 258048 4096 4096
WriteX 13366 0 65471 65471
WriteX 13366 65471 65 65
WriteX 13366 65536 65471 65471
WriteX 13366 131007 65 65
WriteX 13366 131072 65471 65471
WriteX 13366 196543 65 65
WriteX 13366 196608 65471 65471
WriteX 13366 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13367
ReadX 13367 61440 4096 4096
ReadX 13367 126976 4096 4096
ReadX 13367 192512 4096 4096
ReadX 13367 258048 4096 4096
ReadX 13367 323584 4096 4096
ReadX 13367 389120 4096 4096
ReadX 13367 454656 4096 4096
ReadX 13367 520192 4096 4096
WriteX 13367 0 65471 65471
WriteX 13367 65471 65 65
WriteX 13367 65536 65471 65471
WriteX 13367 131007 65 65
WriteX 13367 131072 65471 65471
WriteX 13367 196543 65 65
WriteX 13367 196608 65471 65471
WriteX 13367 262079 65 65
WriteX 13367 262144 65471 65471
WriteX 13367 327615 65 65
WriteX 13367 327680 65471 65471
WriteX 13367 393151 65 65
WriteX 13367 393216 65471 65471
WriteX 13367 458687 65 65
WriteX 13367 458752 65471 65471
WriteX 13367 524223 65 65
Close 13365
Close 13366
Close 13367
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13368
FIND_FIRST \clients\client1\~dmtmp\*
Close 13368
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13369
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13369 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13370
ReadX 13370 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13371
ReadX 13371 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13372
ReadX 13372 0 4096 4096
ReadX 13369 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13369
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13373
ReadX 13373 0 4096 4096
ReadX 13373 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13374
FIND_FIRST \clients\client1\~dmtmp\*
Close 13374
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13375
QUERY_FILE_INFORMATION 13375
WriteX 13375 2047 1 1
QUERY_FILE_INFORMATION 13375
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13376
Close 13376
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13377
WriteX 13377 52 1 1
QUERY_FILE_INFORMATION 13377
WriteX 13377 0 491 491
Close 13377
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13378
ReadX 13378 0 491 491
WriteX 13375 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13373
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13379
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13379 0 4096 4096
ReadX 13379 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13381
Close 13381
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13382
WriteX 13382 52 1 1
QUERY_FILE_INFORMATION 13382
WriteX 13382 0 543 543
Close 13382
Close 13379
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13383
ReadX 13383 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13384
ReadX 13384 0 543 543
ReadX 13383 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13383
Close 13378
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13384
Close 13370
Close 13371
Close 13372
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13375
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13385
FIND_FIRST \clients\client1\~dmtmp\*
Close 13385
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13386
ReadX 13386 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13387
ReadX 13387 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13388
ReadX 13388 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13389
ReadX 13389 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13390
ReadX 13390 0 543 543
ReadX 13386 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13394
FIND_FIRST \clients\client1\~dmtmp\*
Close 13394
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13395
QUERY_FILE_INFORMATION 13395
WriteX 13395 2047 1 1
QUERY_FILE_INFORMATION 13395
WriteX 13395 0 2048 2048
Close 13395
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13396
ReadX 13396 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13396
Close 13386
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13397
ReadX 13397 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13397 4095 1 1
QUERY_FILE_INFORMATION 13397
ReadX 13397 0 4096 4096
WriteX 13397 0 4096 4096
Flush 13397
WriteX 13397 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13398
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13398 0 4096 4096
ReadX 13398 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13402
FIND_FIRST \clients\client1\~dmtmp\*
Close 13402
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13403
WriteX 13403 2047 1 1
QUERY_FILE_INFORMATION 13403
WriteX 13403 0 2048 2048
Close 13403
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13404
ReadX 13404 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13408
Close 13408
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13409
WriteX 13409 2047 1 1
QUERY_FILE_INFORMATION 13409
WriteX 13409 0 2048 2048
Close 13409
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13410
ReadX 13410 0 2048 2048
ReadX 13398 4096 16384 16384
Close 13410
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13411
ReadX 13411 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13411
Close 13390
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13404 4095 1 1
QUERY_FILE_INFORMATION 13404
ReadX 13404 0 4096 4096
WriteX 13404 0 4096 4096
Close 13404
WriteX 13398 0 8192 8192
Close 13398
WriteX 13387 0 4096 4096
WriteX 13388 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13413
ReadX 13413 0 4096 4096
ReadX 13413 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13413
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13414
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13414 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13415
ReadX 13415 0 543 543
ReadX 13414 0 4096 4096
Close 13414
Close 13397
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13416
QUERY_FILE_INFORMATION 13416
Close 13416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13415
Close 13387
Close 13388
Close 13389
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13417
FIND_FIRST \clients\client1\~dmtmp\*
Close 13417
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13418
ReadX 13418 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13419
ReadX 13419 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13420
ReadX 13420 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13421
ReadX 13421 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13422
ReadX 13422 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13423
ReadX 13423 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13424
ReadX 13424 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13425
ReadX 13425 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13426
ReadX 13426 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13427
ReadX 13427 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13428
ReadX 13428 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13429
ReadX 13429 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13430
ReadX 13430 0 4096 4096
ReadX 13418 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13434
FIND_FIRST \clients\client1\~dmtmp\*
Close 13434
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13435
QUERY_FILE_INFORMATION 13435
WriteX 13435 2047 1 1
QUERY_FILE_INFORMATION 13435
WriteX 13435 0 2048 2048
Close 13435
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13436
ReadX 13436 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13436
Close 13426
Close 13418
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13437
ReadX 13437 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13438
FIND_FIRST \clients\client1\~dmtmp\*
Close 13438
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13439
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13439 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13440
ReadX 13440 0 4096 4096
ReadX 13439 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13444
FIND_FIRST \clients\client1\~dmtmp\*
Close 13444
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13445
QUERY_FILE_INFORMATION 13445
WriteX 13445 2047 1 1
QUERY_FILE_INFORMATION 13445
WriteX 13445 0 2048 2048
Close 13445
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13446
ReadX 13446 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13446
Close 13439
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13447
ReadX 13447 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13437 4095 1 1
QUERY_FILE_INFORMATION 13437
ReadX 13437 0 4096 4096
WriteX 13437 0 4096 4096
Flush 13437
WriteX 13447 4095 1 1
QUERY_FILE_INFORMATION 13447
ReadX 13447 0 4096 4096
WriteX 13447 0 4096 4096
Flush 13447
WriteX 13437 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 13447 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13448
ReadX 13448 0 4096 4096
ReadX 13440 0 4096 4096
ReadX 13448 0 4096 4096
ReadX 13448 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13449
FIND_FIRST \clients\client1\~dmtmp\*
Close 13449
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13450
WriteX 13450 4095 1 1
QUERY_FILE_INFORMATION 13450
WriteX 13450 0 4096 4096
Close 13450
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13451
ReadX 13451 0 4096 4096
Close 13448
Close 13440
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13452
Close 13452
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13453
WriteX 13453 4095 1 1
QUERY_FILE_INFORMATION 13453
WriteX 13453 0 4096 4096
Close 13453
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13454
ReadX 13454 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 13454 0 4096 4096
Close 13451
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13430
Close 13424
Close 13427
Close 13428
Close 13429
Close 13425
Close 13419
Close 13422
Close 13423
Close 13420
Close 13421
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13454
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13456
Close 13456
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13457
ReadX 13457 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13458
Close 13458
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13459
WriteX 13459 2047 1 1
QUERY_FILE_INFORMATION 13459
WriteX 13459 0 2048 2048
Close 13459
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13460
ReadX 13460 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13460
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13461
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13461 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13462
ReadX 13462 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13463
ReadX 13463 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13464
ReadX 13464 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13465
ReadX 13465 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13466
ReadX 13466 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13467
ReadX 13467 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13468
ReadX 13468 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13469
ReadX 13469 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13470
ReadX 13470 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13471
ReadX 13471 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13472
ReadX 13472 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13473
ReadX 13473 0 4096 4096
ReadX 13461 0 4096 4096
ReadX 13468 0 4096 4096
Close 13468
Close 13461
Close 13437
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13474
QUERY_FILE_INFORMATION 13474
Close 13474
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13457
Close 13472
Close 13467
Close 13469
Close 13470
Close 13471
Close 13473
Close 13462
Close 13465
Close 13466
Close 13463
Close 13464
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13447
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13475
QUERY_FILE_INFORMATION 13475
Close 13475
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13476
FIND_FIRST \clients\client1\~dmtmp\*
Close 13476
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13477
ReadX 13477 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13478
ReadX 13478 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13479
ReadX 13479 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13480
ReadX 13480 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13481
ReadX 13481 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13482
ReadX 13482 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13483
ReadX 13483 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13484
ReadX 13484 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13485
ReadX 13485 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13486
ReadX 13486 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13487
ReadX 13487 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13488
ReadX 13488 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13489
ReadX 13489 0 4096 4096
ReadX 13477 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13493
FIND_FIRST \clients\client1\~dmtmp\*
Close 13493
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13494
QUERY_FILE_INFORMATION 13494
WriteX 13494 2047 1 1
QUERY_FILE_INFORMATION 13494
WriteX 13494 0 2048 2048
Close 13494
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13495
ReadX 13495 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13495
Close 13477
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13496
ReadX 13496 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13497
FIND_FIRST \clients\client1\~dmtmp\*
Close 13497
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13498
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13498 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13499
ReadX 13499 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13500
ReadX 13500 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13501
ReadX 13501 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13502
ReadX 13502 0 543 543
ReadX 13498 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13506
FIND_FIRST \clients\client1\~dmtmp\*
Close 13506
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13507
QUERY_FILE_INFORMATION 13507
WriteX 13507 2047 1 1
QUERY_FILE_INFORMATION 13507
WriteX 13507 0 2048 2048
Close 13507
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13508
ReadX 13508 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13508
Close 13498
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13509
ReadX 13509 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 13482
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13510
FIND_FIRST \clients\client1\~dmtmp\*
Close 13510
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13511
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13511 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13512
ReadX 13512 0 4096 4096
ReadX 13511 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13516
FIND_FIRST \clients\client1\~dmtmp\*
Close 13516
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13517
QUERY_FILE_INFORMATION 13517
WriteX 13517 2047 1 1
QUERY_FILE_INFORMATION 13517
WriteX 13517 0 2048 2048
Close 13517
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13518
ReadX 13518 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13518
Close 13512
Close 13511
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13519
ReadX 13519 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13496 4095 1 1
QUERY_FILE_INFORMATION 13496
ReadX 13496 0 4096 4096
WriteX 13496 0 4096 4096
Flush 13496
WriteX 13509 4095 1 1
QUERY_FILE_INFORMATION 13509
ReadX 13509 0 4096 4096
WriteX 13509 0 4096 4096
Flush 13509
WriteX 13519 4095 1 1
QUERY_FILE_INFORMATION 13519
ReadX 13519 0 4096 4096
WriteX 13519 0 4096 4096
Flush 13519
WriteX 13496 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 13509 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 13519 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13520
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13520 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13521
ReadX 13521 0 4096 4096
ReadX 13520 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13522
ReadX 13522 0 4096 4096
ReadX 13522 0 4096 4096
ReadX 13522 4096 16384 16384
ReadX 13520 4096 16384 16384
ReadX 13520 0 4096 4096
ReadX 13521 0 4096 4096
ReadX 13521 4096 4096 4096
Close 13522
Close 13521
Close 13520
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13523
FIND_FIRST \clients\client1\~dmtmp\*
Close 13523
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13524
ReadX 13524 0 2048 2048
WriteX 13524 18431 1 1
QUERY_FILE_INFORMATION 13524
WriteX 13524 0 19584 19584
Close 13524
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13525
ReadX 13525 0 4096 4096
ReadX 13525 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13525
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13526
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13526 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13527
ReadX 13527 0 4096 4096
ReadX 13526 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13528
ReadX 13528 0 4096 4096
ReadX 13528 0 4096 4096
Close 13528
Close 13527
Close 13526
Close 13496
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13529
QUERY_FILE_INFORMATION 13529
Close 13529
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13502
Close 13489
Close 13481
Close 13499
Close 13500
Close 13501
Close 13488
Close 13483
Close 13486
Close 13487
Close 13484
Close 13485
Close 13478
Close 13479
Close 13480
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13509
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13530
QUERY_FILE_INFORMATION 13530
Close 13530
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13519
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13531
QUERY_FILE_INFORMATION 13531
Close 13531
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13532
FIND_FIRST \clients\client1\~dmtmp\*
Close 13532
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13533
ReadX 13533 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13534
ReadX 13534 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13535
ReadX 13535 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13536
ReadX 13536 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13537
ReadX 13537 0 543 543
ReadX 13533 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13533 4096 16384 16384
WriteX 13533 0 4096 4096
Close 13533
WriteX 13534 0 4096 4096
WriteX 13535 0 4096 4096
WriteX 13536 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13538
FIND_FIRST \clients\client1\~dmtmp\*
Close 13538
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13539
ReadX 13539 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13540
ReadX 13540 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13541
ReadX 13541 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13542
ReadX 13542 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13543
ReadX 13543 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13544
ReadX 13544 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13545
ReadX 13545 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13546
ReadX 13546 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13547
ReadX 13547 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13548
ReadX 13548 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13549
ReadX 13549 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13550
ReadX 13550 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13551
ReadX 13551 0 4096 4096
ReadX 13539 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13552
ReadX 13552 0 8192 8192
ReadX 13539 4096 16384 16384
Close 13546
Close 13539
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13553
FIND_FIRST \clients\client1\~dmtmp\*
Close 13553
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13554
ReadX 13554 0 4096 4096
ReadX 13554 4096 4096 4096
ReadX 13554 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13555
ReadX 13555 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13556
ReadX 13556 0 4096 4096
ReadX 13555 0 4096 4096
ReadX 13555 0 4096 4096
ReadX 13555 4096 16384 16384
Close 13556
WriteX 13555 0 4096 4096
Close 13555
WriteX 13540 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13557
FIND_FIRST \clients\client1\~dmtmp\*
Close 13557
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13558
ReadX 13558 0 4096 4096
ReadX 13558 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13559
ReadX 13559 0 4096 4096
ReadX 13559 0 4096 4096
WriteX 13559 0 4096 4096
Close 13559
WriteX 13534 0 4096 4096
WriteX 13535 0 4096 4096
WriteX 13536 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13560
ReadX 13560 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13561
ReadX 13561 0 4096 4096
ReadX 13560 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13565
FIND_FIRST \clients\client1\~dmtmp\*
Close 13565
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13566
QUERY_FILE_INFORMATION 13566
WriteX 13566 2047 1 1
QUERY_FILE_INFORMATION 13566
WriteX 13566 0 2048 2048
Close 13566
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13567
ReadX 13567 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13567 4095 1 1
QUERY_FILE_INFORMATION 13567
ReadX 13567 0 4096 4096
WriteX 13567 0 4096 4096
Close 13567
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13568
ReadX 13568 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13568 0 4096 4096
Close 13561
Close 13560
WriteX 13568 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13569
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13569 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13570
ReadX 13570 0 4096 4096
ReadX 13569 0 4096 4096
ReadX 13569 4096 16384 16384
Close 13570
Close 13569
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13571
FIND_FIRST \clients\client1\~dmtmp\*
Close 13571
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13572
ReadX 13572 0 4096 4096
ReadX 13572 4096 4096 4096
WriteX 13572 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13572 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13572
ReadX 13568 0 4096 4096
WriteX 13568 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13573
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13573 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13574
ReadX 13574 0 4096 4096
ReadX 13573 0 4096 4096
ReadX 13573 4096 16384 16384
Close 13574
Close 13573
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13575
FIND_FIRST \clients\client1\~dmtmp\*
Close 13575
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13576
ReadX 13576 0 4096 4096
ReadX 13576 4096 4096 4096
WriteX 13576 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13576 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13576
Close 13568
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13577
QUERY_FILE_INFORMATION 13577
Close 13577
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13552
Close 13554
Close 13558
Close 13537
Close 13534
Close 13535
Close 13536
Close 13545
Close 13550
Close 13547
Close 13548
Close 13549
Close 13551
Close 13540
Close 13543
Close 13544
Close 13541
Close 13542
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13578
FIND_FIRST \clients\client1\~dmtmp\*
Close 13578
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13579
ReadX 13579 0 4096 4096
ReadX 13579 4096 4096 4096
ReadX 13579 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13580
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13580 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13581
ReadX 13581 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13582
ReadX 13582 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13583
ReadX 13583 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13584
ReadX 13584 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13585
ReadX 13585 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13586
ReadX 13586 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13587
ReadX 13587 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13588
ReadX 13588 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13589
ReadX 13589 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13590
ReadX 13590 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13591
ReadX 13591 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13592
ReadX 13592 0 4096 4096
ReadX 13580 0 4096 4096
ReadX 13580 0 4096 4096
ReadX 13580 4096 16384 16384
Close 13587
Close 13580
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13593
ReadX 13593 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13594
ReadX 13594 0 4096 4096
ReadX 13593 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13598
FIND_FIRST \clients\client1\~dmtmp\*
Close 13598
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13599
QUERY_FILE_INFORMATION 13599
WriteX 13599 2047 1 1
QUERY_FILE_INFORMATION 13599
WriteX 13599 0 2048 2048
Close 13599
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13600
ReadX 13600 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13600 4095 1 1
QUERY_FILE_INFORMATION 13600
ReadX 13600 0 4096 4096
WriteX 13600 0 4096 4096
Close 13600
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13601
ReadX 13601 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13601 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13605
Close 13605
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13606
QUERY_FILE_INFORMATION 13606
WriteX 13606 2047 1 1
QUERY_FILE_INFORMATION 13606
WriteX 13606 0 2048 2048
Close 13606
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13607
ReadX 13607 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13607 4095 1 1
QUERY_FILE_INFORMATION 13607
ReadX 13607 0 4096 4096
WriteX 13607 0 4096 4096
Close 13607
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13608
ReadX 13608 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13608 0 4096 4096
Close 13593
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13609
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13609 0 4096 4096
ReadX 13609 0 4096 4096
ReadX 13609 4096 16384 16384
Close 13609
Close 13601
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13610
QUERY_FILE_INFORMATION 13610
Close 13610
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13579
Close 13591
Close 13586
Close 13592
Close 13594
Close 13581
Close 13584
Close 13585
Close 13582
Close 13583
Close 13588
Close 13589
Close 13590
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13608
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13611
QUERY_FILE_INFORMATION 13611
Close 13611
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13612
ReadX 13612 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13613
Close 13613
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13614
WriteX 13614 63 1 1
QUERY_FILE_INFORMATION 13614
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13612 0 4096 4096
ReadX 13612 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13612 0 8192 8192
Flush 13612
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13612 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13612 0 8192 8192
Flush 13612
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13612 0 8192 8192
Flush 13612
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13612 0 8192 8192
Flush 13612
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13616
Close 13616
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13618
WriteX 13618 4065 1 1
QUERY_FILE_INFORMATION 13618
WriteX 13618 0 62591 62591
Close 13618
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13620
Close 13620
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13622
WriteX 13622 4094 1 1
QUERY_FILE_INFORMATION 13622
WriteX 13622 0 10845 10845
Close 13622
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13624
Close 13624
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13626
WriteX 13626 4081 1 1
QUERY_FILE_INFORMATION 13626
WriteX 13626 0 30118 30118
Close 13626
WriteX 13612 0 4096 4096
Close 13612
WriteX 13614 0 64 64
Close 13614
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13627
ReadX 13627 61440 4096 4096
ReadX 13627 126976 4096 4096
WriteX 13627 0 65471 65471
WriteX 13627 65471 65 65
WriteX 13627 65536 65471 65471
WriteX 13627 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13628
ReadX 13628 61440 4096 4096
ReadX 13628 126976 4096 4096
ReadX 13628 192512 4096 4096
ReadX 13628 258048 4096 4096
WriteX 13628 0 65471 65471
WriteX 13628 65471 65 65
WriteX 13628 65536 65471 65471
WriteX 13628 131007 65 65
WriteX 13628 131072 65471 65471
WriteX 13628 196543 65 65
WriteX 13628 196608 65471 65471
WriteX 13628 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13629
ReadX 13629 61440 4096 4096
ReadX 13629 126976 4096 4096
ReadX 13629 192512 4096 4096
ReadX 13629 258048 4096 4096
ReadX 13629 323584 4096 4096
ReadX 13629 389120 4096 4096
ReadX 13629 454656 4096 4096
ReadX 13629 520192 4096 4096
WriteX 13629 0 65471 65471
WriteX 13629 65471 65 65
WriteX 13629 65536 65471 65471
WriteX 13629 131007 65 65
WriteX 13629 131072 65471 65471
WriteX 13629 196543 65 65
WriteX 13629 196608 65471 65471
WriteX 13629 262079 65 65
WriteX 13629 262144 65471 65471
WriteX 13629 327615 65 65
WriteX 13629 327680 65471 65471
WriteX 13629 393151 65 65
WriteX 13629 393216 65471 65471
WriteX 13629 458687 65 65
WriteX 13629 458752 65471 65471
WriteX 13629 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13630
Close 13630
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13627
Close 13628
Close 13629
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13631
ReadX 13631 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13632
ReadX 13632 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13633
ReadX 13633 0 4096 4096
ReadX 13633 4096 4096 4096
ReadX 13633 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13634
Close 13634
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13631
Close 13632
Close 13633
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13635
Close 13635
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13636
ReadX 13636 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13637
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13637
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13638
Close 13638
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13639
ReadX 13639 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13640
Close 13640
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13636
Close 13639
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13641
Close 13641
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13642
ReadX 13642 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13643
ReadX 13643 0 8192 8192
ReadX 13643 8192 8192 8192
ReadX 13643 16384 8192 8192
ReadX 13643 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13645
Close 13645
Close 13642
Close 13643
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13647
WriteX 13647 8191 1 1
QUERY_FILE_INFORMATION 13647
WriteX 13647 0 10438 10438
Close 13647
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13648
Close 13648
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13649
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13650
Close 13650
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13651
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13652
Close 13652
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13653
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13654
FIND_FIRST \clients\client1\~dmtmp\*
Close 13654
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13655
Close 13655
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13656
ReadX 13656 0 4096 4096
Close 13656
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13657
ReadX 13657 0 8192 8192
Close 13657
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13658
ReadX 13658 0 8192 8192
ReadX 13658 8192 4096 4096
ReadX 13658 12288 8192 8192
ReadX 13658 20480 8192 8192
ReadX 13658 28672 8192 8192
ReadX 13658 36864 8192 8192
ReadX 13658 45056 8192 8192
ReadX 13658 53248 8192 8192
ReadX 13658 61440 8192 8192
ReadX 13658 69632 8192 8192
ReadX 13658 77824 8192 8192
ReadX 13658 86016 8192 8192
ReadX 13658 94208 8192 8192
ReadX 13658 102400 8192 8192
ReadX 13658 110592 8192 8192
ReadX 13658 118784 8192 8192
ReadX 13658 126976 8192 8192
ReadX 13658 135168 8192 8192
ReadX 13658 143360 8192 8192
ReadX 13658 151552 8192 8192
ReadX 13658 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13659
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13659
Close 13658
Close 13649
Close 13651
Close 13653
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13660
Close 13660
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13662
WriteX 13662 8191 1 1
QUERY_FILE_INFORMATION 13662
WriteX 13662 0 28489 28489
Close 13662
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13663
Close 13663
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13664
FIND_FIRST \clients\client1\~dmtmp\*
Close 13664
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13665
Close 13665
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13666
ReadX 13666 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13667
Close 13667
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13666
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13668
Close 13668
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13669
ReadX 13669 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13670
ReadX 13670 0 8192 8192
ReadX 13670 8192 8192 8192
ReadX 13670 16384 8192 8192
ReadX 13670 24576 8192 8192
ReadX 13670 32768 16384 16384
ReadX 13670 49152 8192 8192
ReadX 13670 57344 8192 8192
ReadX 13670 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13672
Close 13672
Close 13669
Close 13670
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13674
WriteX 13674 8191 1 1
QUERY_FILE_INFORMATION 13674
WriteX 13674 0 29253 29253
Close 13674
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13675
Close 13675
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13676
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13677
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13677
Close 13676
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13678
Close 13678
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13680
WriteX 13680 8191 1 1
QUERY_FILE_INFORMATION 13680
WriteX 13680 0 30183 30183
Close 13680
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13681
Close 13681
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13682
WriteX 13682 0 510 510
WriteX 13682 510 512 512
WriteX 13682 1022 510 510
WriteX 13682 1532 510 510
WriteX 13682 2042 168 168
Close 13682
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13683
Close 13683
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13684
ReadX 13684 0 4096 4096
WriteX 13684 0 4096 4096
Close 13684
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13685
ReadX 13685 0 65471 65471
ReadX 13685 65471 65 65
ReadX 13685 65536 65471 65471
ReadX 13685 131007 65 65
ReadX 13685 131072 65471 65471
ReadX 13685 196543 65 65
ReadX 13685 196608 65471 65471
ReadX 13685 262079 65 65
ReadX 13685 262144 65471 65471
ReadX 13685 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13686
ReadX 13686 0 65471 65471
ReadX 13686 65471 65 65
ReadX 13686 65536 65471 65471
ReadX 13686 131007 65 65
ReadX 13686 131072 65471 65471
ReadX 13686 196543 65 65
ReadX 13686 196608 65471 65471
ReadX 13686 262079 65 65
ReadX 13686 262144 65471 65471
ReadX 13686 327615 65 65
ReadX 13686 327680 65471 65471
ReadX 13686 393151 65 65
ReadX 13686 393216 65471 65471
ReadX 13686 458687 65 65
ReadX 13686 458752 65471 65471
ReadX 13686 524223 65 65
ReadX 13686 524288 65471 65471
ReadX 13686 589759 65 65
ReadX 13686 589824 65471 65471
ReadX 13686 655295 65 65
ReadX 13686 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13687
ReadX 13687 0 65471 65471
ReadX 13687 65471 65 65
ReadX 13687 65536 65471 65471
ReadX 13687 131007 65 65
ReadX 13687 131072 65471 65471
ReadX 13687 196543 65 65
ReadX 13687 196608 65471 65471
ReadX 13687 262079 65 65
ReadX 13687 262144 65471 65471
ReadX 13687 327615 65 65
ReadX 13687 327680 65471 65471
ReadX 13687 393151 65 65
ReadX 13687 393216 65471 65471
ReadX 13687 458687 65 65
ReadX 13687 458752 65471 65471
ReadX 13687 524223 65 65
ReadX 13687 524288 65471 65471
ReadX 13687 589759 65 65
ReadX 13687 589824 65471 65471
ReadX 13687 655295 65 65
ReadX 13687 655360 65471 65471
ReadX 13687 720831 65 65
ReadX 13687 720896 65471 65471
ReadX 13687 786367 65 65
ReadX 13687 786432 65471 65471
ReadX 13687 851903 65 65
ReadX 13687 851968 65471 65471
ReadX 13687 917439 65 65
ReadX 13687 917504 65471 65471
ReadX 13687 982975 65 65
ReadX 13687 983040 65471 65471
ReadX 13687 1048511 65 65
ReadX 13687 1048576 65471 65471
ReadX 13687 1114047 65 65
ReadX 13687 1114112 65471 65471
ReadX 13687 1179583 65 65
ReadX 13687 1179648 65471 65471
ReadX 13687 1245119 65 65
ReadX 13687 1245184 65471 65471
ReadX 13687 1310655 65 65
ReadX 13687 1310720 65471 65471
ReadX 13687 1376191 65 65
ReadX 13687 1376256 65471 65471
ReadX 13687 1441727 65 65
ReadX 13687 1441792 65471 65471
ReadX 13687 1507263 65 65
ReadX 13687 1507328 65471 65471
ReadX 13687 1572799 65 65
ReadX 13687 1572864 65471 65471
ReadX 13687 1638335 65 65
ReadX 13687 1638400 65471 65471
ReadX 13687 1703871 65 65
ReadX 13687 1703936 65471 65471
ReadX 13687 1769407 65 65
ReadX 13687 1769472 65471 65471
ReadX 13687 1834943 65 65
ReadX 13687 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13688
ReadX 13688 0 4096 4096
ReadX 13688 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13689
WriteX 13689 52 1 1
QUERY_FILE_INFORMATION 13689
WriteX 13689 0 53 53
Close 13689
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13690
Close 13690
Close 13685
Close 13686
Close 13687
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13688 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13691
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13688 0 4096 4096
ReadX 13688 4096 4096 4096
ReadX 13688 8192 4096 4096
ReadX 13688 12288 4096 4096
WriteX 13691 15359 1 1
QUERY_FILE_INFORMATION 13691
ReadX 13688 16384 4096 4096
ReadX 13688 20480 4096 4096
WriteX 13691 0 15360 15360
Close 13691
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13692
ReadX 13692 0 4096 4096
WriteX 13692 0 4096 4096
Close 13692
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13693
Close 13693
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13694
ReadX 13694 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13695
Close 13695
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13688
ReadX 13694 0 4096 4096
ReadX 13694 4096 4096 4096
ReadX 13694 8192 4096 4096
ReadX 13694 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13696
ReadX 13696 0 4096 4096
ReadX 13696 0 4096 4096
ReadX 13696 4096 4096 4096
ReadX 13696 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13697
ReadX 13697 0 4096 4096
ReadX 13697 4096 4096 4096
ReadX 13697 8192 4096 4096
Close 13696
Close 13697
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13698
WriteX 13698 15359 1 1
QUERY_FILE_INFORMATION 13698
WriteX 13698 0 15360 15360
Close 13698
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13699
ReadX 13699 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13694
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13700
Close 13700
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13701
ReadX 13701 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13702
Close 13702
WriteX 13699 0 4096 4096
Close 13699
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13703
Close 13703
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13704
ReadX 13704 0 4096 4096
ReadX 13704 0 4096 4096
ReadX 13704 4096 4096 4096
ReadX 13704 8192 4096 4096
ReadX 13704 12288 3072 3072
ReadX 13704 0 8192 8192
ReadX 13704 8192 4096 4096
ReadX 13704 12288 3072 3072
WriteX 13704 15469 1 1
QUERY_FILE_INFORMATION 13704
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13705
ReadX 13705 0 4096 4096
ReadX 13705 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13706
WriteX 13706 52 1 1
QUERY_FILE_INFORMATION 13706
WriteX 13706 0 53 53
Close 13706
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13707
Close 13707
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13708
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13705 0 8192 8192
ReadX 13705 8192 4096 4096
ReadX 13705 12288 4096 4096
WriteX 13708 12005 1 1
QUERY_FILE_INFORMATION 13708
WriteX 13708 0 12006 12006
Close 13708
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13709
ReadX 13709 0 4096 4096
WriteX 13709 0 4096 4096
Close 13709
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13710
Close 13710
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13711
ReadX 13711 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13712
Close 13712
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13705
ReadX 13711 0 4096 4096
ReadX 13711 4096 4096 4096
ReadX 13711 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13713
WriteX 13713 11990 1 1
QUERY_FILE_INFORMATION 13713
WriteX 13713 0 11991 11991
Close 13713
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13714
ReadX 13714 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13711
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13715
Close 13715
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13716
ReadX 13716 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13717
Close 13717
WriteX 13714 0 4096 4096
Close 13714
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13718
Close 13718
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13719
ReadX 13719 0 4096 4096
ReadX 13719 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13720
Close 13720
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13719 0 8192 8192
ReadX 13719 8192 3799 3799
WriteX 13719 13247 1 1
QUERY_FILE_INFORMATION 13719
WriteX 13719 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13719 0 8192 8192
ReadX 13719 8192 4096 4096
Close 13701
WriteX 13704 0 19054 19054
Close 13704
WriteX 13719 0 12288 12288
Close 13719
Close 13716
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13721
Close 13721
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13722
Close 13722
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13723
ReadX 13723 61440 4096 4096
ReadX 13723 126976 4096 4096
WriteX 13723 0 65471 65471
WriteX 13723 65471 65 65
WriteX 13723 65536 65471 65471
WriteX 13723 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13724
ReadX 13724 61440 4096 4096
ReadX 13724 126976 4096 4096
ReadX 13724 192512 4096 4096
ReadX 13724 258048 4096 4096
WriteX 13724 0 65471 65471
WriteX 13724 65471 65 65
WriteX 13724 65536 65471 65471
WriteX 13724 131007 65 65
WriteX 13724 131072 65471 65471
WriteX 13724 196543 65 65
WriteX 13724 196608 65471 65471
WriteX 13724 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13725
ReadX 13725 61440 4096 4096
ReadX 13725 126976 4096 4096
ReadX 13725 192512 4096 4096
ReadX 13725 258048 4096 4096
ReadX 13725 323584 4096 4096
ReadX 13725 389120 4096 4096
ReadX 13725 454656 4096 4096
ReadX 13725 520192 4096 4096
WriteX 13725 0 65471 65471
WriteX 13725 65471 65 65
WriteX 13725 65536 65471 65471
WriteX 13725 131007 65 65
WriteX 13725 131072 65471 65471
WriteX 13725 196543 65 65
WriteX 13725 196608 65471 65471
WriteX 13725 262079 65 65
WriteX 13725 262144 65471 65471
WriteX 13725 327615 65 65
WriteX 13725 327680 65471 65471
WriteX 13725 393151 65 65
WriteX 13725 393216 65471 65471
WriteX 13725 458687 65 65
WriteX 13725 458752 65471 65471
WriteX 13725 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13726
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13726 0 4096 4096
Close 13726
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13727
ReadX 13727 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13727
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13728
ReadX 13728 0 4096 4096
ReadX 13728 4096 4096 4096
ReadX 13728 8192 4096 4096
ReadX 13728 12288 4096 4096
ReadX 13728 16384 4096 4096
ReadX 13728 20480 4096 4096
ReadX 13728 24576 4096 4096
ReadX 13728 28672 4096 4096
ReadX 13728 32768 4096 4096
ReadX 13728 36864 4096 4096
ReadX 13728 40960 4096 4096
ReadX 13728 45056 4096 4096
ReadX 13728 49152 4096 4096
ReadX 13728 53248 4096 4096
ReadX 13728 57344 4096 4096
ReadX 13728 61440 4096 4096
ReadX 13728 65536 4096 4096
ReadX 13728 69632 4096 4096
ReadX 13728 73728 4096 4096
WriteX 13728 0 4096 4096
Close 13728
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13729
Close 13729
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13730
ReadX 13730 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13731
Close 13731
Close 13723
Close 13724
Close 13725
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13730
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13733
WriteX 13733 4607 1 1
QUERY_FILE_INFORMATION 13733
WriteX 13733 0 65471 65471
WriteX 13733 65471 65 65
WriteX 13733 65536 19979 19979
Close 13733
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13734
ReadX 13734 0 4096 4096
WriteX 13734 0 4096 4096
Flush 13734
WriteX 13734 0 4096 4096
Flush 13734
QUERY_FILE_INFORMATION 13734
WriteX 13734 0 4096 4096
Flush 13734
WriteX 13734 0 4096 4096
Flush 13734
WriteX 13734 0 4096 4096
Flush 13734
WriteX 13734 0 4096 4096
Flush 13734
Close 13734
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13735
ReadX 13735 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13736
ReadX 13736 0 4096 4096
Close 13735
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13737
ReadX 13737 0 4096 4096
Close 13737
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13738
ReadX 13738 0 4096 4096
Close 13738
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13739
ReadX 13739 0 4096 4096
WriteX 13739 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13740
Close 13740
Close 13736
Close 13739
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13741
Close 13741
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13743
WriteX 13743 4607 1 1
QUERY_FILE_INFORMATION 13743
WriteX 13743 0 65471 65471
WriteX 13743 65471 65 65
WriteX 13743 65536 17654 17654
Close 13743
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13744
ReadX 13744 0 4096 4096
WriteX 13744 0 4096 4096
Flush 13744
WriteX 13744 0 4096 4096
Flush 13744
QUERY_FILE_INFORMATION 13744
WriteX 13744 0 4096 4096
Flush 13744
WriteX 13744 0 4096 4096
Flush 13744
WriteX 13744 0 4096 4096
Flush 13744
WriteX 13744 0 4096 4096
Flush 13744
Close 13744
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13745
Close 13745
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13746
ReadX 13746 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13747
Close 13747
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13748
ReadX 13748 0 4096 4096
ReadX 13748 4096 4096 4096
ReadX 13748 8192 4096 4096
ReadX 13748 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13748 16384 4096 4096
ReadX 13748 20480 4096 4096
ReadX 13748 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13746
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13749
ReadX 13749 0 4096 4096
Close 13749
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13750
ReadX 13750 0 4096 4096
Close 13750
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13751
ReadX 13751 0 4096 4096
WriteX 13751 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13752
Close 13752
Close 13751
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13753
Close 13753
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13755
WriteX 13755 4607 1 1
QUERY_FILE_INFORMATION 13755
WriteX 13755 0 65471 65471
WriteX 13755 65471 65 65
WriteX 13755 65536 19490 19490
Close 13755
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13756
ReadX 13756 0 4096 4096
WriteX 13756 0 4096 4096
Flush 13756
WriteX 13756 0 4096 4096
Flush 13756
QUERY_FILE_INFORMATION 13756
WriteX 13756 0 4096 4096
Flush 13756
WriteX 13756 0 4096 4096
Flush 13756
WriteX 13756 0 4096 4096
Flush 13756
WriteX 13756 0 4096 4096
Flush 13756
Close 13756
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13757
Close 13757
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13758
ReadX 13758 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13759
Close 13759
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13758
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13760
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13760 0 4096 4096
Close 13760
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13761
ReadX 13761 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13761
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13762
ReadX 13762 0 4096 4096
ReadX 13762 4096 4096 4096
ReadX 13762 8192 4096 4096
ReadX 13762 12288 4096 4096
ReadX 13762 16384 4096 4096
ReadX 13762 20480 4096 4096
ReadX 13762 24576 4096 4096
ReadX 13762 28672 4096 4096
ReadX 13762 32768 4096 4096
ReadX 13762 36864 4096 4096
ReadX 13762 40960 4096 4096
ReadX 13762 45056 4096 4096
ReadX 13762 49152 4096 4096
ReadX 13762 53248 4096 4096
ReadX 13762 57344 4096 4096
ReadX 13762 61440 4096 4096
ReadX 13762 65536 4096 4096
ReadX 13762 69632 4096 4096
ReadX 13762 73728 4096 4096
WriteX 13762 0 4096 4096
Close 13762
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13763
Close 13763
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13764
ReadX 13764 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13765
Close 13765
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13764
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13767
WriteX 13767 4607 1 1
QUERY_FILE_INFORMATION 13767
WriteX 13767 0 65471 65471
WriteX 13767 65471 65 65
WriteX 13767 65536 8866 8866
Close 13767
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13768
ReadX 13768 0 4096 4096
WriteX 13768 0 4096 4096
Flush 13768
WriteX 13768 0 4096 4096
Flush 13768
Close 13768
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13769
ReadX 13769 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13769
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13770
ReadX 13770 0 4096 4096
Close 13770
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13771
ReadX 13771 0 4096 4096
Close 13771
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13772
ReadX 13772 0 4096 4096
WriteX 13772 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13773
Close 13773
Close 13772
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13774
Close 13774
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13776
WriteX 13776 4607 1 1
QUERY_FILE_INFORMATION 13776
WriteX 13776 0 65471 65471
WriteX 13776 65471 65 65
WriteX 13776 65536 9298 9298
Close 13776
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13777
ReadX 13777 0 4096 4096
WriteX 13777 0 4096 4096
Flush 13777
WriteX 13777 0 4096 4096
Flush 13777
Close 13777
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13778
Close 13778
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13779
ReadX 13779 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13780
Close 13780
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13782
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13782 0 4096 4096
Close 13782
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13783
ReadX 13783 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13783 4096 4096 4096
ReadX 13783 8192 4096 4096
ReadX 13783 12288 4096 4096
ReadX 13783 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13779
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13784
ReadX 13784 0 4096 4096
Close 13784
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13785
ReadX 13785 0 4096 4096
Close 13785
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13786
ReadX 13786 0 4096 4096
WriteX 13786 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13787
Close 13787
Close 13783
Close 13786
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13788
Close 13788
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13790
WriteX 13790 4607 1 1
QUERY_FILE_INFORMATION 13790
WriteX 13790 0 65471 65471
WriteX 13790 65471 65 65
WriteX 13790 65536 11540 11540
Close 13790
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13791
ReadX 13791 0 4096 4096
WriteX 13791 0 4096 4096
Flush 13791
WriteX 13791 0 4096 4096
Flush 13791
Close 13791
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13792
Close 13792
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13793
ReadX 13793 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13794
Close 13794
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13793
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13795
ReadX 13795 0 65471 65471
ReadX 13795 65471 65 65
ReadX 13795 65536 65471 65471
ReadX 13795 131007 65 65
ReadX 13795 131072 65471 65471
ReadX 13795 196543 65 65
ReadX 13795 196608 65471 65471
ReadX 13795 262079 65 65
ReadX 13795 262144 65471 65471
ReadX 13795 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13796
ReadX 13796 0 65471 65471
ReadX 13796 65471 65 65
ReadX 13796 65536 65471 65471
ReadX 13796 131007 65 65
Close 13748
ReadX 13796 131072 65471 65471
Close 13795
ReadX 13796 196543 65 65
ReadX 13796 196608 65471 65471
ReadX 13796 262079 65 65
ReadX 13796 262144 65471 65471
ReadX 13796 327615 65 65
ReadX 13796 327680 65471 65471
ReadX 13796 393151 65 65
ReadX 13796 393216 65471 65471
ReadX 13796 458687 65 65
ReadX 13796 458752 65471 65471
ReadX 13796 524223 65 65
ReadX 13796 524288 65471 65471
ReadX 13796 589759 65 65
ReadX 13796 589824 65471 65471
ReadX 13796 655295 65 65
ReadX 13796 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13797
ReadX 13797 0 65471 65471
ReadX 13797 65471 65 65
ReadX 13797 65536 65471 65471
ReadX 13797 131007 65 65
ReadX 13797 131072 65471 65471
ReadX 13797 196543 65 65
ReadX 13797 196608 65471 65471
ReadX 13797 262079 65 65
ReadX 13797 262144 65471 65471
ReadX 13797 327615 65 65
ReadX 13797 327680 65471 65471
ReadX 13797 393151 65 65
ReadX 13797 393216 65471 65471
ReadX 13797 458687 65 65
ReadX 13797 458752 65471 65471
ReadX 13797 524223 65 65
ReadX 13797 524288 65471 65471
ReadX 13797 589759 65 65
ReadX 13797 589824 65471 65471
ReadX 13797 655295 65 65
ReadX 13797 655360 65471 65471
ReadX 13797 720831 65 65
ReadX 13797 720896 65471 65471
ReadX 13797 786367 65 65
ReadX 13797 786432 65471 65471
ReadX 13797 851903 65 65
ReadX 13797 851968 65471 65471
ReadX 13797 917439 65 65
ReadX 13797 917504 65471 65471
ReadX 13797 982975 65 65
ReadX 13797 983040 65471 65471
ReadX 13797 1048511 65 65
ReadX 13797 1048576 65471 65471
ReadX 13797 1114047 65 65
ReadX 13797 1114112 65471 65471
ReadX 13797 1179583 65 65
ReadX 13797 1179648 65471 65471
ReadX 13797 1245119 65 65
ReadX 13797 1245184 65471 65471
ReadX 13797 1310655 65 65
ReadX 13797 1310720 65471 65471
ReadX 13797 1376191 65 65
ReadX 13797 1376256 65471 65471
ReadX 13797 1441727 65 65
ReadX 13797 1441792 65471 65471
ReadX 13797 1507263 65 65
ReadX 13797 1507328 65471 65471
ReadX 13797 1572799 65 65
ReadX 13797 1572864 65471 65471
ReadX 13797 1638335 65 65
ReadX 13797 1638400 65471 65471
ReadX 13797 1703871 65 65
ReadX 13797 1703936 65471 65471
ReadX 13797 1769407 65 65
ReadX 13797 1769472 65471 65471
ReadX 13797 1834943 65 65
ReadX 13797 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13798
FIND_FIRST \clients\client1\~dmtmp\*
Close 13798
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13799
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13800
QUERY_FILE_INFORMATION 13800
QUERY_FILE_INFORMATION 13800
QUERY_FILE_INFORMATION 13800
ReadX 13800 2156 24 24
ReadX 13800 2139 276 276
ReadX 13800 2136 14 14
ReadX 13800 2136 7 7
ReadX 13800 2138 12 12
ReadX 13800 2137 8 8
ReadX 13800 2135 15 15
ReadX 13800 0 16 16
ReadX 13800 16 2048 2048
ReadX 13800 2064 2048 2048
ReadX 13800 257 2048 2048
ReadX 13800 385 2048 2048
ReadX 13800 513 2048 2048
ReadX 13800 641 2048 2048
ReadX 13800 769 2048 2048
ReadX 13800 897 2048 2048
ReadX 13800 1025 2048 2048
ReadX 13800 1153 2048 2048
ReadX 13800 1281 2048 2048
ReadX 13800 1409 2048 2048
ReadX 13800 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13802
Close 13802
Close 13796
Close 13797
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13804
WriteX 13804 15 1 1
QUERY_FILE_INFORMATION 13804
WriteX 13804 0 10575 10575
Flush 13804
Close 13804
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13805
Close 13805
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13806
ReadX 13806 0 4096 4096
Close 13800
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13807
Close 13807
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13808
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13809
QUERY_FILE_INFORMATION 13809
ReadX 13809 0 512 512
ReadX 13809 512 512 512
ReadX 13809 1024 512 512
QUERY_FILE_INFORMATION 13809
QUERY_FILE_INFORMATION 13809
Close 13809
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13810
QUERY_FILE_INFORMATION 13810
ReadX 13810 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13811
QUERY_FILE_INFORMATION 13811
ReadX 13811 0 512 512
ReadX 13811 512 512 512
ReadX 13811 1024 512 512
ReadX 13811 288 20 20
ReadX 13811 308 2084 2084
ReadX 13811 388 2084 2084
ReadX 13811 388 2084 2084
ReadX 13799 2157 1386 1386
ReadX 13811 2472 399 399
ReadX 13811 3072 1536 1536
ReadX 13811 544 149 149
ReadX 13811 693 485 485
Close 13811
ReadX 13799 2157 4096 4096
ReadX 13799 6253 4096 4096
ReadX 13799 10349 4096 4096
ReadX 13799 14445 4096 4096
ReadX 13799 18541 4096 4096
ReadX 13799 22637 256 256
ReadX 13799 22893 4096 4096
ReadX 13799 26989 4096 4096
ReadX 13799 31085 4096 4096
ReadX 13799 35181 4096 4096
ReadX 13799 39277 4096 4096
ReadX 13799 43373 4096 4096
ReadX 13799 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13799 2157 1024 1024
ReadX 13799 1667 4688 4688
ReadX 13799 6355 3516 3516
ReadX 13799 9871 16384 16384
ReadX 13799 26255 3771 3771
ReadX 13799 30026 2048 2048
ReadX 13799 32074 1024 1024
ReadX 13799 33098 6652 6652
ReadX 13799 39750 16384 16384
ReadX 13799 56134 10496 10496
ReadX 13799 66630 1784 1784
ReadX 13799 68414 90 90
ReadX 13799 68504 273 273
ReadX 13799 68777 1600 1600
ReadX 13799 70377 640 640
ReadX 13799 71017 1280 1280
ReadX 13799 72297 8464 8464
ReadX 13799 80761 158 158
ReadX 13799 80919 912 912
ReadX 13799 81831 1980 1980
ReadX 13799 83811 2256 2256
ReadX 13799 86067 400 400
ReadX 13799 86467 252 252
ReadX 13799 86719 42 42
ReadX 13799 86761 725 725
ReadX 13799 2009 512 512
ReadX 13799 3895 9 9
ReadX 13799 3781 46 46
ReadX 13799 4059 92 92
ReadX 13799 3781 92 92
ReadX 13799 3986 184 184
ReadX 13799 3987 16384 16384
ReadX 13799 3902 16384 16384
ReadX 13799 3781 10240 10240
ReadX 13799 3821 16384 16384
ReadX 13799 3891 935 935
ReadX 13799 4060 10240 10240
ReadX 13799 4059 184 184
ReadX 13799 256 184 184
ReadX 13799 256 1026 1026
ReadX 13799 3901 326 326
ReadX 13799 3899 652 652
ReadX 13799 256 2 2
ReadX 13799 258 4948 4948
Close 13799
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13813
Close 13813
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13815
WriteX 13815 4055 1 1
QUERY_FILE_INFORMATION 13815
WriteX 13815 0 65471 65471
WriteX 13815 65471 65 65
WriteX 13815 65536 65471 65471
WriteX 13815 131007 65 65
WriteX 13815 131072 65471 65471
WriteX 13815 196543 65 65
WriteX 13815 196608 65471 65471
WriteX 13815 262079 65 65
WriteX 13815 262144 65471 65471
WriteX 13815 327615 65 65
WriteX 13815 327680 65471 65471
WriteX 13815 393151 65 65
WriteX 13815 393216 65471 65471
WriteX 13815 458687 65 65
WriteX 13815 458752 65471 65471
WriteX 13815 524223 65 65
WriteX 13815 524288 65471 65471
WriteX 13815 589759 65 65
WriteX 13815 589824 35257 35257
Close 13815
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13817
Close 13817
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13819
WriteX 13819 4055 1 1
QUERY_FILE_INFORMATION 13819
WriteX 13819 0 65471 65471
WriteX 13819 65471 65 65
WriteX 13819 65536 65471 65471
WriteX 13819 131007 65 65
WriteX 13819 131072 65471 65471
WriteX 13819 196543 65 65
WriteX 13819 196608 65471 65471
WriteX 13819 262079 65 65
WriteX 13819 262144 65471 65471
WriteX 13819 327615 65 65
WriteX 13819 327680 65471 65471
WriteX 13819 393151 65 65
WriteX 13819 393216 65471 65471
WriteX 13819 458687 65 65
WriteX 13819 458752 65471 65471
WriteX 13819 524223 65 65
WriteX 13819 524288 65471 65471
WriteX 13819 589759 65 65
WriteX 13819 589824 57598 57598
Close 13819
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13821
WriteX 13821 15 1 1
QUERY_FILE_INFORMATION 13821
WriteX 13821 0 12543 12543
Flush 13821
Close 13821
Close 13806
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13822
Close 13822
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13823
ReadX 13823 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13824
FIND_FIRST \clients\client1\~dmtmp\*
Close 13824
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13825
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13826
QUERY_FILE_INFORMATION 13826
QUERY_FILE_INFORMATION 13826
QUERY_FILE_INFORMATION 13826
ReadX 13826 1938 24 24
ReadX 13826 1920 276 276
ReadX 13826 1918 14 14
ReadX 13826 1918 7 7
ReadX 13826 1919 12 12
ReadX 13826 1919 8 8
ReadX 13826 1917 15 15
ReadX 13826 0 16 16
ReadX 13826 16 2048 2048
ReadX 13826 2064 2048 2048
ReadX 13826 257 2048 2048
ReadX 13826 385 2048 2048
ReadX 13826 513 2048 2048
ReadX 13826 641 2048 2048
ReadX 13826 769 2048 2048
ReadX 13826 897 2048 2048
ReadX 13826 1025 2048 2048
ReadX 13826 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13828
Close 13828
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13830
WriteX 13830 15 1 1
QUERY_FILE_INFORMATION 13830
WriteX 13830 0 11588 11588
Flush 13830
Close 13830
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13831
Close 13831
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13832
ReadX 13832 0 4096 4096
Close 13826
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13834
WriteX 13834 15 1 1
QUERY_FILE_INFORMATION 13834
WriteX 13834 0 11615 11615
Flush 13834
Close 13834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13832
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13835
Close 13835
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13836
ReadX 13836 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13838
Close 13838
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13840
WriteX 13840 4088 1 1
QUERY_FILE_INFORMATION 13840
WriteX 13840 0 65471 65471
WriteX 13840 65471 65 65
WriteX 13840 65536 16050 16050
Close 13840
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13825 1939 64 64
ReadX 13825 128 248 248
ReadX 13825 128 568 568
ReadX 13825 3872 1536 1536
ReadX 13825 3456 2560 2560
ReadX 13825 3136 512 512
ReadX 13825 2880 4096 4096
ReadX 13825 3264 3072 3072
ReadX 13825 320 4096 4096
ReadX 13825 1024 4096 4096
ReadX 13825 3616 4096 4096
ReadX 13825 1939 64 64
ReadX 13825 128 248 248
ReadX 13825 128 608 608
ReadX 13825 2858 1024 1024
ReadX 13825 2810 4096 4096
ReadX 13825 2826 4096 4096
ReadX 13825 2580 2048 2048
ReadX 13825 2800 2560 2560
ReadX 13825 2100 4096 4096
ReadX 13825 2084 4096 4096
ReadX 13825 868 4096 4096
ReadX 13825 2324 4096 4096
ReadX 13825 884 4096 4096
ReadX 13825 2604 1024 1024
ReadX 13825 580 4096 4096
ReadX 13825 596 4096 4096
ReadX 13825 2752 4096 4096
ReadX 13825 2842 1024 1024
ReadX 13825 660 4096 4096
ReadX 13825 2720 4096 4096
ReadX 13825 2736 4096 4096
ReadX 13825 628 4096 4096
ReadX 13825 2704 4096 4096
ReadX 13825 1556 4096 4096
ReadX 13825 576 4096 4096
ReadX 13825 3168 1536 1536
ReadX 13825 832 4096 4096
ReadX 13825 1088 4096 4096
ReadX 13825 1344 4096 4096
ReadX 13825 1600 4096 4096
ReadX 13825 1856 4096 4096
ReadX 13825 2112 4096 4096
ReadX 13825 1892 4096 4096
ReadX 13825 820 4096 4096
ReadX 13825 788 4096 4096
ReadX 13825 1604 4096 4096
ReadX 13825 3648 4096 4096
ReadX 13825 2608 4096 4096
ReadX 13825 548 4096 4096
ReadX 13825 740 4096 4096
ReadX 13825 1344 4096 4096
ReadX 13825 3392 4096 4096
ReadX 13825 3904 4096 4096
ReadX 13825 644 4096 4096
ReadX 13825 676 4096 4096
ReadX 13825 2688 4096 4096
ReadX 13825 320 4096 4096
ReadX 13825 900 4096 4096
ReadX 13825 1908 4096 4096
ReadX 13825 852 4096 4096
ReadX 13825 724 4096 4096
ReadX 13825 2292 4096 4096
ReadX 13825 612 4096 4096
ReadX 13825 388 4096 4096
ReadX 13825 2368 4096 4096
ReadX 13825 2624 4096 4096
ReadX 13825 500 4096 4096
ReadX 13825 356 4096 4096
ReadX 13825 1024 4096 4096
ReadX 13825 576 4096 4096
ReadX 13825 340 4096 4096
ReadX 13825 420 4096 4096
ReadX 13825 1600 4096 4096
ReadX 13825 404 4096 4096
ReadX 13825 1428 4096 4096
ReadX 13825 2656 4096 4096
ReadX 13825 2624 4096 4096
ReadX 13825 452 4096 4096
ReadX 13825 692 4096 4096
ReadX 13825 564 4096 4096
ReadX 13825 372 4096 4096
ReadX 13825 468 4096 4096
ReadX 13825 484 4096 4096
ReadX 13825 1088 4096 4096
ReadX 13825 1924 4096 4096
ReadX 13825 2768 4096 4096
ReadX 13825 832 4096 4096
ReadX 13825 836 4096 4096
ReadX 13825 1856 4096 4096
ReadX 13825 2640 4096 4096
ReadX 13825 436 4096 4096
ReadX 13825 1828 4096 4096
ReadX 13825 804 4096 4096
ReadX 13825 1860 4096 4096
ReadX 13825 1812 4096 4096
ReadX 13825 756 4096 4096
ReadX 13825 1636 4096 4096
ReadX 13825 772 4096 4096
ReadX 13825 2036 4096 4096
ReadX 13825 1220 4096 4096
ReadX 13825 1652 4096 4096
ReadX 13825 2588 4096 4096
ReadX 13825 916 4096 4096
ReadX 13825 260 4096 4096
ReadX 13825 932 4096 4096
ReadX 13825 2624 4096 4096
ReadX 13825 308 4096 4096
ReadX 13825 292 4096 4096
ReadX 13825 1140 4096 4096
ReadX 13825 276 4096 4096
ReadX 13825 2020 4096 4096
ReadX 13825 2880 4096 4096
ReadX 13825 516 4096 4096
ReadX 13825 1844 4096 4096
ReadX 13825 1124 4096 4096
ReadX 13825 3136 4096 4096
ReadX 13825 324 4096 4096
ReadX 13825 1156 4096 4096
ReadX 13825 1172 4096 4096
ReadX 13825 2112 4096 4096
ReadX 13825 2368 4096 4096
ReadX 13825 964 4096 4096
ReadX 13825 980 4096 4096
ReadX 13825 1012 4096 4096
ReadX 13825 532 4096 4096
ReadX 13825 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13825 1620 4096 4096
ReadX 13825 1604 4096 4096
ReadX 13825 2116 4096 4096
ReadX 13825 2132 4096 4096
ReadX 13825 2148 4096 4096
ReadX 13825 2276 4096 4096
ReadX 13825 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13842
Close 13842
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13844
QUERY_FILE_INFORMATION 13808
Close 13808
WriteX 13844 4088 1 1
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13810
Close 13810
WriteX 13844 0 65471 65471
WriteX 13844 65471 65 65
WriteX 13844 65536 64850 64850
Close 13844
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13846
WriteX 13846 15 1 1
QUERY_FILE_INFORMATION 13846
ReadX 13825 2068 4096 4096
ReadX 13825 1588 4096 4096
ReadX 13825 1572 4096 4096
WriteX 13846 0 18630 18630
Flush 13846
Close 13846
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13836
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13847
Close 13847
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13848
ReadX 13848 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13825 612 4096 4096
ReadX 13825 564 4096 4096
ReadX 13825 1876 4096 4096
ReadX 13825 628 4096 4096
ReadX 13825 740 4096 4096
ReadX 13825 724 4096 4096
ReadX 13825 644 4096 4096
ReadX 13825 2324 4096 4096
ReadX 13825 660 4096 4096
ReadX 13825 852 4096 4096
ReadX 13825 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13825 2368 4096 4096
ReadX 13825 1024 4096 4096
ReadX 13825 320 4096 4096
ReadX 13825 580 4096 4096
ReadX 13825 3136 512 512
ReadX 13825 2880 4096 4096
Close 13825
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13849
ReadX 13849 61440 4096 4096
ReadX 13849 126976 4096 4096
WriteX 13849 0 65471 65471
WriteX 13849 65471 65 65
WriteX 13849 65536 65471 65471
WriteX 13849 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13850
ReadX 13850 61440 4096 4096
ReadX 13850 126976 4096 4096
ReadX 13850 192512 4096 4096
ReadX 13850 258048 4096 4096
WriteX 13850 0 65471 65471
WriteX 13850 65471 65 65
WriteX 13850 65536 65471 65471
WriteX 13850 131007 65 65
WriteX 13850 131072 65471 65471
WriteX 13850 196543 65 65
WriteX 13850 196608 65471 65471
WriteX 13850 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13851
ReadX 13851 61440 4096 4096
ReadX 13851 126976 4096 4096
ReadX 13851 192512 4096 4096
ReadX 13851 258048 4096 4096
ReadX 13851 323584 4096 4096
ReadX 13851 389120 4096 4096
ReadX 13851 454656 4096 4096
ReadX 13851 520192 4096 4096
WriteX 13851 0 65471 65471
WriteX 13851 65471 65 65
WriteX 13851 65536 65471 65471
WriteX 13851 131007 65 65
WriteX 13851 131072 65471 65471
WriteX 13851 196543 65 65
WriteX 13851 196608 65471 65471
WriteX 13851 262079 65 65
WriteX 13851 262144 65471 65471
WriteX 13851 327615 65 65
WriteX 13851 327680 65471 65471
WriteX 13851 393151 65 65
WriteX 13851 393216 65471 65471
WriteX 13851 458687 65 65
WriteX 13851 458752 65471 65471
WriteX 13851 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13852
Close 13852
Close 13848
Close 13823
Close 13849
Close 13850
Close 13851
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13853
Close 13853
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13856
Close 13856
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13858
Close 13858
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13859
Close 13859
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13862
Close 13862
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13864
Close 13864
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13865
Close 13865
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13868
Close 13868
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13872
Close 13872
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13876
Close 13876
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13880
Close 13880
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13884
Close 13884
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13888
Close 13888
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13892
Close 13892
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13896
Close 13896
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13898
Close 13898
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13900
Close 13900
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13902
WriteX 13902 4095 1 1
QUERY_FILE_INFORMATION 13902
QUERY_FS_INFORMATION 259
WriteX 13902 0 65471 65471
WriteX 13902 65471 65 65
WriteX 13902 65536 65471 65471
WriteX 13902 131007 65 65
WriteX 13902 131072 65471 65471
WriteX 13902 196543 65 65
WriteX 13902 196608 65471 65471
WriteX 13902 262079 65 65
WriteX 13902 262144 26634 26634
Close 13902
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13907
Close 13907
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13908
Close 13908
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13909
ReadX 13909 0 4096 4096
Close 13909
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13910
ReadX 13910 0 4096 4096
ReadX 13910 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13911
Close 13911
Close 13910
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13914
Close 13914
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13916
Close 13916
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13917
Close 13917
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13920
Close 13920
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13922
Close 13922
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13923
Close 13923
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13926
Close 13926
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13930
Close 13930
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13934
Close 13934
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13938
Close 13938
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13942
Close 13942
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13946
Close 13946
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13949
Close 13949
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13953
Close 13953
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13957
Close 13957
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13959
Close 13959
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13960
Close 13960
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13969
Close 13969
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13970
FIND_FIRST \clients\client1\~dmtmp\*
Close 13970
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13971
Close 13971
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13972
ReadX 13972 0 4096 4096
Close 13972
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13973
ReadX 13973 0 4096 4096
Close 13973
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13974
ReadX 13974 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13984
Close 13984
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13985
FIND_FIRST \clients\client1\~dmtmp\*
Close 13985
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13986
Close 13986
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13987
ReadX 13987 0 4096 4096
Close 13987
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13988
ReadX 13988 0 4096 4096
Close 13988
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13989
ReadX 13989 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
Close 13974
Close 13989
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13990
ReadX 13990 0 65471 65471
ReadX 13990 65471 65 65
ReadX 13990 65536 65471 65471
ReadX 13990 131007 65 65
ReadX 13990 131072 65471 65471
ReadX 13990 196543 65 65
ReadX 13990 196608 65471 65471
ReadX 13990 262079 65 65
ReadX 13990 262144 65471 65471
ReadX 13990 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13991
ReadX 13991 0 65471 65471
ReadX 13991 65471 65 65
ReadX 13991 65536 65471 65471
ReadX 13991 131007 65 65
ReadX 13991 131072 65471 65471
ReadX 13991 196543 65 65
ReadX 13991 196608 65471 65471
ReadX 13991 262079 65 65
ReadX 13991 262144 65471 65471
ReadX 13991 327615 65 65
ReadX 13991 327680 65471 65471
ReadX 13991 393151 65 65
ReadX 13991 393216 65471 65471
ReadX 13991 458687 65 65
ReadX 13991 458752 65471 65471
ReadX 13991 524223 65 65
ReadX 13991 524288 65471 65471
ReadX 13991 589759 65 65
ReadX 13991 589824 65471 65471
ReadX 13991 655295 65 65
ReadX 13991 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13992
ReadX 13992 0 65471 65471
ReadX 13992 65471 65 65
ReadX 13992 65536 65471 65471
ReadX 13992 131007 65 65
ReadX 13992 131072 65471 65471
ReadX 13992 196543 65 65
ReadX 13992 196608 65471 65471
ReadX 13992 262079 65 65
ReadX 13992 262144 65471 65471
ReadX 13992 327615 65 65
ReadX 13992 327680 65471 65471
ReadX 13992 393151 65 65
ReadX 13992 393216 65471 65471
ReadX 13992 458687 65 65
ReadX 13992 458752 65471 65471
ReadX 13992 524223 65 65
ReadX 13992 524288 65471 65471
ReadX 13992 589759 65 65
ReadX 13992 589824 65471 65471
ReadX 13992 655295 65 65
ReadX 13992 655360 65471 65471
ReadX 13992 720831 65 65
ReadX 13992 720896 65471 65471
ReadX 13992 786367 65 65
ReadX 13992 786432 65471 65471
ReadX 13992 851903 65 65
ReadX 13992 851968 65471 65471
ReadX 13992 917439 65 65
ReadX 13992 917504 65471 65471
ReadX 13992 982975 65 65
ReadX 13992 983040 65471 65471
ReadX 13992 1048511 65 65
ReadX 13992 1048576 65471 65471
ReadX 13992 1114047 65 65
ReadX 13992 1114112 65471 65471
ReadX 13992 1179583 65 65
ReadX 13992 1179648 65471 65471
ReadX 13992 1245119 65 65
ReadX 13992 1245184 65471 65471
ReadX 13992 1310655 65 65
ReadX 13992 1310720 65471 65471
ReadX 13992 1376191 65 65
ReadX 13992 1376256 65471 65471
ReadX 13992 1441727 65 65
ReadX 13992 1441792 65471 65471
ReadX 13992 1507263 65 65
ReadX 13992 1507328 65471 65471
ReadX 13992 1572799 65 65
ReadX 13992 1572864 65471 65471
ReadX 13992 1638335 65 65
ReadX 13992 1638400 65471 65471
ReadX 13992 1703871 65 65
ReadX 13992 1703936 65471 65471
ReadX 13992 1769407 65 65
ReadX 13992 1769472 65471 65471
ReadX 13992 1834943 65 65
ReadX 13992 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13993
ReadX 13993 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13993 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13993 8192 4096 4096
ReadX 13993 12288 4096 4096
ReadX 13993 16384 4096 4096
ReadX 13993 20480 4096 4096
ReadX 13993 24576 4096 4096
ReadX 13993 28672 4096 4096
ReadX 13993 32768 4096 4096
ReadX 13993 36864 4096 4096
ReadX 13993 40960 4096 4096
ReadX 13993 45056 4096 4096
ReadX 13993 49152 4096 4096
ReadX 13993 53248 4096 4096
ReadX 13993 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13993 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13994
Close 13994
Close 13990
Close 13991
Close 13992
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13995
WriteX 13995 1535 1 1
QUERY_FILE_INFORMATION 13995
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13993 0 4096 4096
ReadX 13993 4096 4096 4096
QUERY_FILE_INFORMATION 13995
WriteX 13995 0 57088 57088
WriteX 13995 0 4096 4096
Flush 13995
Close 13993
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13996
Close 13996
WriteX 13995 0 4096 4096
Close 13995
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13997
Close 13997
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13998
ReadX 13998 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13998 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13999
WriteX 13999 1535 1 1
QUERY_FILE_INFORMATION 13999
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13998 0 4096 4096
QUERY_FILE_INFORMATION 13999
WriteX 13999 0 51456 51456
WriteX 13999 0 4096 4096
Flush 13999
Close 13998
WriteX 13999 0 4096 4096
Close 13999
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 14000
Close 14000
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14001
ReadX 14001 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14001 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14003
Close 14003
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14005
WriteX 14005 4045 1 1
QUERY_FILE_INFORMATION 14005
WriteX 14005 0 53077 53077
Close 14005
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 14006
WriteX 14006 1535 1 1
QUERY_FILE_INFORMATION 14006
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14001 0 4096 4096
QUERY_FILE_INFORMATION 14006
WriteX 14006 0 65471 65471
WriteX 14006 65471 65 65
WriteX 14006 65536 1856 1856
WriteX 14006 0 4096 4096
Flush 14006
Close 14001
WriteX 14006 0 4096 4096
Close 14006
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 14007
Close 14007
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14008
ReadX 14008 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14010
Close 14010
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14012
WriteX 14012 4076 1 1
QUERY_FILE_INFORMATION 14012
WriteX 14012 0 7983 7983
Close 14012
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14014
Close 14014
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14016
WriteX 14016 4095 1 1
QUERY_FILE_INFORMATION 14016
WriteX 14016 0 65471 65471
WriteX 14016 65471 65 65
WriteX 14016 65536 65471 65471
WriteX 14016 131007 65 65
WriteX 14016 131072 65471 65471
WriteX 14016 196543 65 65
WriteX 14016 196608 65471 65471
WriteX 14016 262079 65 65
WriteX 14016 262144 65471 65471
WriteX 14016 327615 65 65
WriteX 14016 327680 65471 65471
WriteX 14016 393151 65 65
WriteX 14016 393216 65471 65471
WriteX 14016 458687 65 65
WriteX 14016 458752 46731 46731
Close 14016
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 14017
WriteX 14017 1535 1 1
QUERY_FILE_INFORMATION 14017
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14008 0 4096 4096
ReadX 14008 4096 4096 4096
QUERY_FILE_INFORMATION 14017
WriteX 14017 0 65471 65471
WriteX 14017 65471 65 65
WriteX 14017 65536 22848 22848
WriteX 14017 0 4096 4096
Flush 14017
Close 14008
WriteX 14017 0 4096 4096
Close 14017
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 14018
Close 14018
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14019
ReadX 14019 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14019 4096 4096 4096
Close 14019
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14020
ReadX 14020 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14020 0 8192 8192
ReadX 14020 8192 4096 4096
ReadX 14020 12288 4096 4096
ReadX 14020 16384 4096 4096
ReadX 14020 20480 4096 4096
ReadX 14020 24576 4096 4096
ReadX 14020 28672 4096 4096
ReadX 14020 32768 4096 4096
ReadX 14020 36864 4096 4096
ReadX 14020 40960 4096 4096
ReadX 14020 45056 4096 4096
ReadX 14020 49152 4096 4096
ReadX 14020 53248 4096 4096
ReadX 14020 57344 4096 4096
ReadX 14020 61440 4096 4096
ReadX 14020 65536 4096 4096
ReadX 14020 69632 4096 4096
ReadX 14020 73728 4096 4096
ReadX 14020 77824 4096 4096
ReadX 14020 81920 4096 4096
ReadX 14020 86016 4096 4096
ReadX 14020 90112 4096 4096
ReadX 14020 94208 4096 4096
ReadX 14020 98304 4096 4096
ReadX 14020 102400 4096 4096
ReadX 14020 106496 4096 4096
ReadX 14020 110592 4096 4096
ReadX 14020 114688 4096 4096
ReadX 14020 118784 4096 4096
ReadX 14020 122880 4096 4096
ReadX 14020 126976 4096 4096
ReadX 14020 131072 4096 4096
ReadX 14020 135168 4096 4096
ReadX 14020 139264 4096 4096
ReadX 14020 143360 4096 4096
ReadX 14020 147456 4096 4096
ReadX 14020 151552 4096 4096
ReadX 14020 155648 4096 4096
ReadX 14020 159744 4096 4096
ReadX 14020 163840 4096 4096
ReadX 14020 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 14020 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 14021
Close 14021
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 14022
WriteX 14022 2047 1 1
QUERY_FILE_INFORMATION 14022
Close 14020
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14023
Close 14023
WriteX 14022 0 42388 42388
Close 14022
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 14024
Close 14024
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 14025
ReadX 14025 0 4096 4096
ReadX 14025 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 14026
WriteX 14026 2047 1 1
QUERY_FILE_INFORMATION 14026
Close 14025
WriteX 14026 0 42652 42652
Close 14026
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 14027
Close 14027
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 14028
ReadX 14028 0 4096 4096
ReadX 14028 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14030
Close 14030
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14032
WriteX 14032 4080 1 1
QUERY_FILE_INFORMATION 14032
WriteX 14032 0 65471 65471
WriteX 14032 65471 65 65
WriteX 14032 65536 49 49
Close 14032
Close 14028
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14033
ReadX 14033 61440 4096 4096
ReadX 14033 126976 4096 4096
WriteX 14033 0 65471 65471
WriteX 14033 65471 65 65
WriteX 14033 65536 65471 65471
WriteX 14033 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14034
ReadX 14034 61440 4096 4096
ReadX 14034 126976 4096 4096
ReadX 14034 192512 4096 4096
ReadX 14034 258048 4096 4096
WriteX 14034 0 65471 65471
WriteX 14034 65471 65 65
WriteX 14034 65536 65471 65471
WriteX 14034 131007 65 65
WriteX 14034 131072 65471 65471
WriteX 14034 196543 65 65
WriteX 14034 196608 65471 65471
WriteX 14034 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14035
ReadX 14035 61440 4096 4096
ReadX 14035 126976 4096 4096
ReadX 14035 192512 4096 4096
ReadX 14035 258048 4096 4096
ReadX 14035 323584 4096 4096
ReadX 14035 389120 4096 4096
ReadX 14035 454656 4096 4096
ReadX 14035 520192 4096 4096
WriteX 14035 0 65471 65471
WriteX 14035 65471 65 65
WriteX 14035 65536 65471 65471
WriteX 14035 131007 65 65
WriteX 14035 131072 65471 65471
WriteX 14035 196543 65 65
WriteX 14035 196608 65471 65471
WriteX 14035 262079 65 65
WriteX 14035 262144 65471 65471
WriteX 14035 327615 65 65
WriteX 14035 327680 65471 65471
WriteX 14035 393151 65 65
WriteX 14035 393216 65471 65471
WriteX 14035 458687 65 65
WriteX 14035 458752 65471 65471
WriteX 14035 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14036
FIND_FIRST \clients\client1\~dmtmp\*
Close 14036
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14037
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14037 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14038
ReadX 14038 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14039
ReadX 14039 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14040
ReadX 14040 0 4096 4096
ReadX 14037 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14037
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14041
ReadX 14041 0 4096 4096
ReadX 14041 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 14042
FIND_FIRST \clients\client1\~dmtmp\*
Close 14042
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 14043
QUERY_FILE_INFORMATION 14043
WriteX 14043 2047 1 1
QUERY_FILE_INFORMATION 14043
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 14044
Close 14044
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 14045
WriteX 14045 52 1 1
QUERY_FILE_INFORMATION 14045
WriteX 14045 0 491 491
Close 14045
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 14046
ReadX 14046 0 491 491
WriteX 14043 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 14041
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14047
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14047 0 4096 4096
ReadX 14047 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 14049
Close 14049
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14050
WriteX 14050 52 1 1
QUERY_FILE_INFORMATION 14050
WriteX 14050 0 543 543
Close 14050
Close 14047
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14051
ReadX 14051 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14052
ReadX 14052 0 543 543
ReadX 14051 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14051
Close 14046
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 14033
Close 14034
Close 14035
Close 14052
Close 14038
Close 14039
Close 14040
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 14043
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14053
FIND_FIRST \clients\client1\~dmtmp\*
Close 14053
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14054
ReadX 14054 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14055
ReadX 14055 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14056
ReadX 14056 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14057
ReadX 14057 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14058
ReadX 14058 0 543 543
ReadX 14054 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 14062
FIND_FIRST \clients\client1\~dmtmp\*
Close 14062
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14063
QUERY_FILE_INFORMATION 14063
WriteX 14063 2047 1 1
QUERY_FILE_INFORMATION 14063
WriteX 14063 0 2048 2048
Close 14063
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14064
ReadX 14064 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 14064
Close 14054
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14065
ReadX 14065 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 14065 4095 1 1
QUERY_FILE_INFORMATION 14065
ReadX 14065 0 4096 4096
WriteX 14065 0 4096 4096
Flush 14065
WriteX 14065 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14066
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14066 0 4096 4096
ReadX 14066 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 14070
FIND_FIRST \clients\client1\~dmtmp\*
Close 14070
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14071
WriteX 14071 2047 1 1
QUERY_FILE_INFORMATION 14071
WriteX 14071 0 2048 2048
Close 14071
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14072
ReadX 14072 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 14076
Close 14076
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14077
WriteX 14077 2047 1 1
QUERY_FILE_INFORMATION 14077
WriteX 14077 0 2048 2048
Close 14077
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14078
ReadX 14078 0 2048 2048
ReadX 14066 4096 16384 16384
Close 14078
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14079
ReadX 14079 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 14079
Close 14058
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 14072 4095 1 1
QUERY_FILE_INFORMATION 14072
ReadX 14072 0 4096 4096
WriteX 14072 0 4096 4096
Close 14072
WriteX 14066 0 8192 8192
Close 14066
WriteX 14055 0 4096 4096
WriteX 14056 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14081
ReadX 14081 0 4096 4096
ReadX 14081 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14081
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14082
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14082 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14083
ReadX 14083 0 543 543
ReadX 14082 0 4096 4096
Close 14082
Close 14065
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14084
QUERY_FILE_INFORMATION 14084
Close 14084
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 14083
Close 14055
Close 14056
Close 14057
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14085
FIND_FIRST \clients\client1\~dmtmp\*
Close 14085
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14086
ReadX 14086 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14087
ReadX 14087 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14088
ReadX 14088 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14089
ReadX 14089 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14090
ReadX 14090 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14091
ReadX 14091 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14092
ReadX 14092 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 14093
ReadX 14093 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14094
ReadX 14094 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 14095
ReadX 14095 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12243
ReadX 12243 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12244
ReadX 12244 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12245
ReadX 12245 0 4096 4096
ReadX 14086 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12249
FIND_FIRST \clients\client1\~dmtmp\*
Close 12249
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12250
QUERY_FILE_INFORMATION 12250
WriteX 12250 2047 1 1
QUERY_FILE_INFORMATION 12250
WriteX 12250 0 2048 2048
Close 12250
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12251
ReadX 12251 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12251
Close 14094
Close 14086
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12252
ReadX 12252 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12253
FIND_FIRST \clients\client1\~dmtmp\*
Close 12253
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12254
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12254 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12255
ReadX 12255 0 4096 4096
ReadX 12254 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12259
FIND_FIRST \clients\client1\~dmtmp\*
Close 12259
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12260
QUERY_FILE_INFORMATION 12260
WriteX 12260 2047 1 1
QUERY_FILE_INFORMATION 12260
WriteX 12260 0 2048 2048
Close 12260
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12261
ReadX 12261 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12261
Close 12254
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12262
ReadX 12262 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12252 4095 1 1
QUERY_FILE_INFORMATION 12252
ReadX 12252 0 4096 4096
WriteX 12252 0 4096 4096
Flush 12252
WriteX 12262 4095 1 1
QUERY_FILE_INFORMATION 12262
ReadX 12262 0 4096 4096
WriteX 12262 0 4096 4096
Flush 12262
WriteX 12252 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 12262 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12263
ReadX 12263 0 4096 4096
ReadX 12255 0 4096 4096
ReadX 12263 0 4096 4096
ReadX 12263 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12264
FIND_FIRST \clients\client1\~dmtmp\*
Close 12264
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12265
WriteX 12265 4095 1 1
QUERY_FILE_INFORMATION 12265
WriteX 12265 0 4096 4096
Close 12265
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12266
ReadX 12266 0 4096 4096
Close 12263
Close 12255
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12267
Close 12267
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12268
WriteX 12268 4095 1 1
QUERY_FILE_INFORMATION 12268
WriteX 12268 0 4096 4096
Close 12268
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12269
ReadX 12269 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 12269 0 4096 4096
Close 12266
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12245
Close 14092
Close 14095
Close 12243
Close 12244
Close 14093
Close 14087
Close 14090
Close 14091
Close 14088
Close 14089
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12269
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12271
Close 12271
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12272
ReadX 12272 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12273
Close 12273
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12274
WriteX 12274 2047 1 1
QUERY_FILE_INFORMATION 12274
WriteX 12274 0 2048 2048
Close 12274
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12275
ReadX 12275 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12275
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12276
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12276 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12277
ReadX 12277 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12278
ReadX 12278 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12279
ReadX 12279 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12280
ReadX 12280 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12281
ReadX 12281 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12282
ReadX 12282 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12283
ReadX 12283 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12284
ReadX 12284 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12285
ReadX 12285 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12286
ReadX 12286 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12287
ReadX 12287 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12288
ReadX 12288 0 4096 4096
ReadX 12276 0 4096 4096
ReadX 12283 0 4096 4096
Close 12283
Close 12276
Close 12252
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12289
QUERY_FILE_INFORMATION 12289
Close 12289
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12272
Close 12287
Close 12282
Close 12284
Close 12285
Close 12286
Close 12288
Close 12277
Close 12280
Close 12281
Close 12278
Close 12279
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12262
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12290
QUERY_FILE_INFORMATION 12290
Close 12290
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12291
FIND_FIRST \clients\client1\~dmtmp\*
Close 12291
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12292
ReadX 12292 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12293
ReadX 12293 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12294
ReadX 12294 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12295
ReadX 12295 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12296
ReadX 12296 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12297
ReadX 12297 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12298
ReadX 12298 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12299
ReadX 12299 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12300
ReadX 12300 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12301
ReadX 12301 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12302
ReadX 12302 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12303
ReadX 12303 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12304
ReadX 12304 0 4096 4096
ReadX 12292 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12308
FIND_FIRST \clients\client1\~dmtmp\*
Close 12308
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12309
QUERY_FILE_INFORMATION 12309
WriteX 12309 2047 1 1
QUERY_FILE_INFORMATION 12309
WriteX 12309 0 2048 2048
Close 12309
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12310
ReadX 12310 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12310
Close 12292
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12311
ReadX 12311 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12312
FIND_FIRST \clients\client1\~dmtmp\*
Close 12312
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12313
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12313 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12314
ReadX 12314 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12315
ReadX 12315 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12316
ReadX 12316 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12317
ReadX 12317 0 543 543
ReadX 12313 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12321
FIND_FIRST \clients\client1\~dmtmp\*
Close 12321
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12322
QUERY_FILE_INFORMATION 12322
WriteX 12322 2047 1 1
QUERY_FILE_INFORMATION 12322
WriteX 12322 0 2048 2048
Close 12322
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12323
ReadX 12323 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12323
Close 12313
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12324
ReadX 12324 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 12297
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12325
FIND_FIRST \clients\client1\~dmtmp\*
Close 12325
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12326
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12326 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12327
ReadX 12327 0 4096 4096
ReadX 12326 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12331
FIND_FIRST \clients\client1\~dmtmp\*
Close 12331
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12332
QUERY_FILE_INFORMATION 12332
WriteX 12332 2047 1 1
QUERY_FILE_INFORMATION 12332
WriteX 12332 0 2048 2048
Close 12332
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12333
ReadX 12333 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12333
Close 12327
Close 12326
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12334
ReadX 12334 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12311 4095 1 1
QUERY_FILE_INFORMATION 12311
ReadX 12311 0 4096 4096
WriteX 12311 0 4096 4096
Flush 12311
WriteX 12324 4095 1 1
QUERY_FILE_INFORMATION 12324
ReadX 12324 0 4096 4096
WriteX 12324 0 4096 4096
Flush 12324
WriteX 12334 4095 1 1
QUERY_FILE_INFORMATION 12334
ReadX 12334 0 4096 4096
WriteX 12334 0 4096 4096
Flush 12334
WriteX 12311 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 12324 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 12334 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12335
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12335 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12336
ReadX 12336 0 4096 4096
ReadX 12335 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12337
ReadX 12337 0 4096 4096
ReadX 12337 0 4096 4096
ReadX 12337 4096 16384 16384
ReadX 12335 4096 16384 16384
ReadX 12335 0 4096 4096
ReadX 12336 0 4096 4096
ReadX 12336 4096 4096 4096
Close 12337
Close 12336
Close 12335
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12338
FIND_FIRST \clients\client1\~dmtmp\*
Close 12338
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12339
ReadX 12339 0 2048 2048
WriteX 12339 18431 1 1
QUERY_FILE_INFORMATION 12339
WriteX 12339 0 19584 19584
Close 12339
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12340
ReadX 12340 0 4096 4096
ReadX 12340 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12340
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12341
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12341 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12342
ReadX 12342 0 4096 4096
ReadX 12341 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12343
ReadX 12343 0 4096 4096
ReadX 12343 0 4096 4096
Close 12343
Close 12342
Close 12341
Close 12311
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12344
QUERY_FILE_INFORMATION 12344
Close 12344
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12317
Close 12304
Close 12296
Close 12314
Close 12315
Close 12316
Close 12303
Close 12298
Close 12301
Close 12302
Close 12299
Close 12300
Close 12293
Close 12294
Close 12295
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12324
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12345
QUERY_FILE_INFORMATION 12345
Close 12345
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12334
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12346
QUERY_FILE_INFORMATION 12346
Close 12346
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12347
FIND_FIRST \clients\client1\~dmtmp\*
Close 12347
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12348
ReadX 12348 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12349
ReadX 12349 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12350
ReadX 12350 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12351
ReadX 12351 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12352
ReadX 12352 0 543 543
ReadX 12348 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12348 4096 16384 16384
WriteX 12348 0 4096 4096
Close 12348
WriteX 12349 0 4096 4096
WriteX 12350 0 4096 4096
WriteX 12351 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12353
FIND_FIRST \clients\client1\~dmtmp\*
Close 12353
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12354
ReadX 12354 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12355
ReadX 12355 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12356
ReadX 12356 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12357
ReadX 12357 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12358
ReadX 12358 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12359
ReadX 12359 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12360
ReadX 12360 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12361
ReadX 12361 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12362
ReadX 12362 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12363
ReadX 12363 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12364
ReadX 12364 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12365
ReadX 12365 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12366
ReadX 12366 0 4096 4096
ReadX 12354 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12367
ReadX 12367 0 8192 8192
ReadX 12354 4096 16384 16384
Close 12361
Close 12354
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12368
FIND_FIRST \clients\client1\~dmtmp\*
Close 12368
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12369
ReadX 12369 0 4096 4096
ReadX 12369 4096 4096 4096
ReadX 12369 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12370
ReadX 12370 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12371
ReadX 12371 0 4096 4096
ReadX 12370 0 4096 4096
ReadX 12370 0 4096 4096
ReadX 12370 4096 16384 16384
Close 12371
WriteX 12370 0 4096 4096
Close 12370
WriteX 12355 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12372
FIND_FIRST \clients\client1\~dmtmp\*
Close 12372
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12373
ReadX 12373 0 4096 4096
ReadX 12373 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12374
ReadX 12374 0 4096 4096
ReadX 12374 0 4096 4096
WriteX 12374 0 4096 4096
Close 12374
WriteX 12349 0 4096 4096
WriteX 12350 0 4096 4096
WriteX 12351 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12375
ReadX 12375 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12376
ReadX 12376 0 4096 4096
ReadX 12375 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12380
FIND_FIRST \clients\client1\~dmtmp\*
Close 12380
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12381
QUERY_FILE_INFORMATION 12381
WriteX 12381 2047 1 1
QUERY_FILE_INFORMATION 12381
WriteX 12381 0 2048 2048
Close 12381
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12382
ReadX 12382 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12382 4095 1 1
QUERY_FILE_INFORMATION 12382
ReadX 12382 0 4096 4096
WriteX 12382 0 4096 4096
Close 12382
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12383
ReadX 12383 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12383 0 4096 4096
Close 12376
Close 12375
WriteX 12383 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12384
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12384 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12385
ReadX 12385 0 4096 4096
ReadX 12384 0 4096 4096
ReadX 12384 4096 16384 16384
Close 12385
Close 12384
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12386
FIND_FIRST \clients\client1\~dmtmp\*
Close 12386
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12387
ReadX 12387 0 4096 4096
ReadX 12387 4096 4096 4096
WriteX 12387 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12387 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12387
ReadX 12383 0 4096 4096
WriteX 12383 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12388
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12388 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12389
ReadX 12389 0 4096 4096
ReadX 12388 0 4096 4096
ReadX 12388 4096 16384 16384
Close 12389
Close 12388
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12390
FIND_FIRST \clients\client1\~dmtmp\*
Close 12390
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12391
ReadX 12391 0 4096 4096
ReadX 12391 4096 4096 4096
WriteX 12391 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12391 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12391
Close 12383
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12392
QUERY_FILE_INFORMATION 12392
Close 12392
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 12367
Close 12369
Close 12373
Close 12352
Close 12349
Close 12350
Close 12351
Close 12360
Close 12365
Close 12362
Close 12363
Close 12364
Close 12366
Close 12355
Close 12358
Close 12359
Close 12356
Close 12357
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12393
FIND_FIRST \clients\client1\~dmtmp\*
Close 12393
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12394
ReadX 12394 0 4096 4096
ReadX 12394 4096 4096 4096
ReadX 12394 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12395
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12395 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12396
ReadX 12396 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12397
ReadX 12397 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12398
ReadX 12398 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12399
ReadX 12399 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12400
ReadX 12400 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12401
ReadX 12401 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12402
ReadX 12402 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12403
ReadX 12403 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12404
ReadX 12404 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12405
ReadX 12405 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12406
ReadX 12406 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12407
ReadX 12407 0 4096 4096
ReadX 12395 0 4096 4096
ReadX 12395 0 4096 4096
ReadX 12395 4096 16384 16384
Close 12402
Close 12395
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12408
ReadX 12408 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12409
ReadX 12409 0 4096 4096
ReadX 12408 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12413
FIND_FIRST \clients\client1\~dmtmp\*
Close 12413
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12414
QUERY_FILE_INFORMATION 12414
WriteX 12414 2047 1 1
QUERY_FILE_INFORMATION 12414
WriteX 12414 0 2048 2048
Close 12414
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12415
ReadX 12415 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12415 4095 1 1
QUERY_FILE_INFORMATION 12415
ReadX 12415 0 4096 4096
WriteX 12415 0 4096 4096
Close 12415
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12416
ReadX 12416 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12416 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12420
Close 12420
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12421
QUERY_FILE_INFORMATION 12421
WriteX 12421 2047 1 1
QUERY_FILE_INFORMATION 12421
WriteX 12421 0 2048 2048
Close 12421
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12422
ReadX 12422 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12422 4095 1 1
QUERY_FILE_INFORMATION 12422
ReadX 12422 0 4096 4096
WriteX 12422 0 4096 4096
Close 12422
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12423
ReadX 12423 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12423 0 4096 4096
Close 12408
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12424
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12424 0 4096 4096
ReadX 12424 0 4096 4096
ReadX 12424 4096 16384 16384
Close 12424
Close 12416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12425
QUERY_FILE_INFORMATION 12425
Close 12425
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12394
Close 12406
Close 12401
Close 12407
Close 12409
Close 12396
Close 12399
Close 12400
Close 12397
Close 12398
Close 12403
Close 12404
Close 12405
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12423
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12426
QUERY_FILE_INFORMATION 12426
Close 12426
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12427
ReadX 12427 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 12428
Close 12428
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 12429
WriteX 12429 63 1 1
QUERY_FILE_INFORMATION 12429
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12427 0 4096 4096
ReadX 12427 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12427 0 8192 8192
Flush 12427
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12427 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12427 0 8192 8192
Flush 12427
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12427 0 8192 8192
Flush 12427
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12427 0 8192 8192
Flush 12427
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12431
Close 12431
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12433
WriteX 12433 4065 1 1
QUERY_FILE_INFORMATION 12433
WriteX 12433 0 62591 62591
Close 12433
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12435
Close 12435
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12437
WriteX 12437 4094 1 1
QUERY_FILE_INFORMATION 12437
WriteX 12437 0 10845 10845
Close 12437
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12439
Close 12439
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12441
WriteX 12441 4081 1 1
QUERY_FILE_INFORMATION 12441
WriteX 12441 0 30118 30118
Close 12441
WriteX 12427 0 4096 4096
Close 12427
WriteX 12429 0 64 64
Close 12429
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12442
ReadX 12442 61440 4096 4096
ReadX 12442 126976 4096 4096
WriteX 12442 0 65471 65471
WriteX 12442 65471 65 65
WriteX 12442 65536 65471 65471
WriteX 12442 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12443
ReadX 12443 61440 4096 4096
ReadX 12443 126976 4096 4096
ReadX 12443 192512 4096 4096
ReadX 12443 258048 4096 4096
WriteX 12443 0 65471 65471
WriteX 12443 65471 65 65
WriteX 12443 65536 65471 65471
WriteX 12443 131007 65 65
WriteX 12443 131072 65471 65471
WriteX 12443 196543 65 65
WriteX 12443 196608 65471 65471
WriteX 12443 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12444
ReadX 12444 61440 4096 4096
ReadX 12444 126976 4096 4096
ReadX 12444 192512 4096 4096
ReadX 12444 258048 4096 4096
ReadX 12444 323584 4096 4096
ReadX 12444 389120 4096 4096
ReadX 12444 454656 4096 4096
ReadX 12444 520192 4096 4096
WriteX 12444 0 65471 65471
WriteX 12444 65471 65 65
WriteX 12444 65536 65471 65471
WriteX 12444 131007 65 65
WriteX 12444 131072 65471 65471
WriteX 12444 196543 65 65
WriteX 12444 196608 65471 65471
WriteX 12444 262079 65 65
WriteX 12444 262144 65471 65471
WriteX 12444 327615 65 65
WriteX 12444 327680 65471 65471
WriteX 12444 393151 65 65
WriteX 12444 393216 65471 65471
WriteX 12444 458687 65 65
WriteX 12444 458752 65471 65471
WriteX 12444 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12445
Close 12445
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12442
Close 12443
Close 12444
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12446
ReadX 12446 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12447
ReadX 12447 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 12448
ReadX 12448 0 4096 4096
ReadX 12448 4096 4096 4096
ReadX 12448 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12449
Close 12449
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12446
Close 12447
Close 12448
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12450
Close 12450
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12451
ReadX 12451 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12452
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 12452
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12453
Close 12453
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12454
ReadX 12454 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12455
Close 12455
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12451
Close 12454
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12456
Close 12456
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12457
ReadX 12457 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12458
ReadX 12458 0 8192 8192
ReadX 12458 8192 8192 8192
ReadX 12458 16384 8192 8192
ReadX 12458 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12460
Close 12460
Close 12457
Close 12458
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12462
WriteX 12462 8191 1 1
QUERY_FILE_INFORMATION 12462
WriteX 12462 0 10438 10438
Close 12462
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12463
Close 12463
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12464
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12465
Close 12465
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12466
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12467
Close 12467
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12468
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12469
FIND_FIRST \clients\client1\~dmtmp\*
Close 12469
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12470
Close 12470
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12471
ReadX 12471 0 4096 4096
Close 12471
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12472
ReadX 12472 0 8192 8192
Close 12472
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12473
ReadX 12473 0 8192 8192
ReadX 12473 8192 4096 4096
ReadX 12473 12288 8192 8192
ReadX 12473 20480 8192 8192
ReadX 12473 28672 8192 8192
ReadX 12473 36864 8192 8192
ReadX 12473 45056 8192 8192
ReadX 12473 53248 8192 8192
ReadX 12473 61440 8192 8192
ReadX 12473 69632 8192 8192
ReadX 12473 77824 8192 8192
ReadX 12473 86016 8192 8192
ReadX 12473 94208 8192 8192
ReadX 12473 102400 8192 8192
ReadX 12473 110592 8192 8192
ReadX 12473 118784 8192 8192
ReadX 12473 126976 8192 8192
ReadX 12473 135168 8192 8192
ReadX 12473 143360 8192 8192
ReadX 12473 151552 8192 8192
ReadX 12473 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 12474
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12474
Close 12473
Close 12464
Close 12466
Close 12468
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 12475
Close 12475
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12477
WriteX 12477 8191 1 1
QUERY_FILE_INFORMATION 12477
WriteX 12477 0 28489 28489
Close 12477
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12478
Close 12478
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12479
FIND_FIRST \clients\client1\~dmtmp\*
Close 12479
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12480
Close 12480
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12481
ReadX 12481 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12482
Close 12482
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12481
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12483
Close 12483
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12484
ReadX 12484 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12485
ReadX 12485 0 8192 8192
ReadX 12485 8192 8192 8192
ReadX 12485 16384 8192 8192
ReadX 12485 24576 8192 8192
ReadX 12485 32768 16384 16384
ReadX 12485 49152 8192 8192
ReadX 12485 57344 8192 8192
ReadX 12485 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12487
Close 12487
Close 12484
Close 12485
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12489
WriteX 12489 8191 1 1
QUERY_FILE_INFORMATION 12489
WriteX 12489 0 29253 29253
Close 12489
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12490
Close 12490
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12491
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 12492
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12492
Close 12491
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 12493
Close 12493
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12495
WriteX 12495 8191 1 1
QUERY_FILE_INFORMATION 12495
WriteX 12495 0 30183 30183
Close 12495
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12496
Close 12496
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12497
WriteX 12497 0 510 510
WriteX 12497 510 512 512
WriteX 12497 1022 510 510
WriteX 12497 1532 510 510
WriteX 12497 2042 168 168
Close 12497
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12498
Close 12498
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12499
ReadX 12499 0 4096 4096
WriteX 12499 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12500
ReadX 12500 0 65471 65471
ReadX 12500 65471 65 65
ReadX 12500 65536 65471 65471
ReadX 12500 131007 65 65
ReadX 12500 131072 65471 65471
ReadX 12500 196543 65 65
ReadX 12500 196608 65471 65471
ReadX 12500 262079 65 65
ReadX 12500 262144 65471 65471
ReadX 12500 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12501
ReadX 12501 0 65471 65471
ReadX 12501 65471 65 65
ReadX 12501 65536 65471 65471
ReadX 12501 131007 65 65
ReadX 12501 131072 65471 65471
ReadX 12501 196543 65 65
ReadX 12501 196608 65471 65471
ReadX 12501 262079 65 65
ReadX 12501 262144 65471 65471
ReadX 12501 327615 65 65
ReadX 12501 327680 65471 65471
ReadX 12501 393151 65 65
ReadX 12501 393216 65471 65471
ReadX 12501 458687 65 65
ReadX 12501 458752 65471 65471
ReadX 12501 524223 65 65
ReadX 12501 524288 65471 65471
ReadX 12501 589759 65 65
ReadX 12501 589824 65471 65471
ReadX 12501 655295 65 65
ReadX 12501 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12502
ReadX 12502 0 65471 65471
ReadX 12502 65471 65 65
ReadX 12502 65536 65471 65471
ReadX 12502 131007 65 65
ReadX 12502 131072 65471 65471
ReadX 12502 196543 65 65
ReadX 12502 196608 65471 65471
ReadX 12502 262079 65 65
ReadX 12502 262144 65471 65471
ReadX 12502 327615 65 65
ReadX 12502 327680 65471 65471
ReadX 12502 393151 65 65
ReadX 12502 393216 65471 65471
ReadX 12502 458687 65 65
ReadX 12502 458752 65471 65471
ReadX 12502 524223 65 65
ReadX 12502 524288 65471 65471
ReadX 12502 589759 65 65
ReadX 12502 589824 65471 65471
ReadX 12502 655295 65 65
ReadX 12502 655360 65471 65471
ReadX 12502 720831 65 65
ReadX 12502 720896 65471 65471
ReadX 12502 786367 65 65
ReadX 12502 786432 65471 65471
ReadX 12502 851903 65 65
ReadX 12502 851968 65471 65471
ReadX 12502 917439 65 65
ReadX 12502 917504 65471 65471
ReadX 12502 982975 65 65
ReadX 12502 983040 65471 65471
ReadX 12502 1048511 65 65
ReadX 12502 1048576 65471 65471
ReadX 12502 1114047 65 65
ReadX 12502 1114112 65471 65471
ReadX 12502 1179583 65 65
ReadX 12502 1179648 65471 65471
ReadX 12502 1245119 65 65
ReadX 12502 1245184 65471 65471
ReadX 12502 1310655 65 65
ReadX 12502 1310720 65471 65471
ReadX 12502 1376191 65 65
ReadX 12502 1376256 65471 65471
ReadX 12502 1441727 65 65
ReadX 12502 1441792 65471 65471
ReadX 12502 1507263 65 65
ReadX 12502 1507328 65471 65471
ReadX 12502 1572799 65 65
ReadX 12502 1572864 65471 65471
ReadX 12502 1638335 65 65
ReadX 12502 1638400 65471 65471
ReadX 12502 1703871 65 65
ReadX 12502 1703936 65471 65471
ReadX 12502 1769407 65 65
ReadX 12502 1769472 65471 65471
ReadX 12502 1834943 65 65
ReadX 12502 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12503
ReadX 12503 0 4096 4096
ReadX 12503 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 12504
WriteX 12504 52 1 1
QUERY_FILE_INFORMATION 12504
WriteX 12504 0 53 53
Close 12504
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12505
Close 12505
Close 12499
Close 12500
Close 12501
Close 12502
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12503 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12506
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12503 0 4096 4096
ReadX 12503 4096 4096 4096
ReadX 12503 8192 4096 4096
ReadX 12503 12288 4096 4096
WriteX 12506 15359 1 1
QUERY_FILE_INFORMATION 12506
ReadX 12503 16384 4096 4096
ReadX 12503 20480 4096 4096
WriteX 12506 0 15360 15360
Close 12506
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 12507
ReadX 12507 0 4096 4096
WriteX 12507 0 4096 4096
Close 12507
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 12508
Close 12508
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12509
ReadX 12509 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 12510
Close 12510
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 12503
ReadX 12509 0 4096 4096
ReadX 12509 4096 4096 4096
ReadX 12509 8192 4096 4096
ReadX 12509 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12511
ReadX 12511 0 4096 4096
ReadX 12511 0 4096 4096
ReadX 12511 4096 4096 4096
ReadX 12511 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12512
ReadX 12512 0 4096 4096
ReadX 12512 4096 4096 4096
ReadX 12512 8192 4096 4096
Close 12511
Close 12512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12513
WriteX 12513 15359 1 1
QUERY_FILE_INFORMATION 12513
WriteX 12513 0 15360 15360
Close 12513
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 12514
ReadX 12514 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 12509
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12515
Close 12515
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12516
ReadX 12516 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 12517
Close 12517
WriteX 12514 0 4096 4096
Close 12514
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 12518
Close 12518
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12519
ReadX 12519 0 4096 4096
ReadX 12519 0 4096 4096
ReadX 12519 4096 4096 4096
ReadX 12519 8192 4096 4096
ReadX 12519 12288 3072 3072
ReadX 12519 0 8192 8192
ReadX 12519 8192 4096 4096
ReadX 12519 12288 3072 3072
WriteX 12519 15469 1 1
QUERY_FILE_INFORMATION 12519
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12520
ReadX 12520 0 4096 4096
ReadX 12520 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 12521
WriteX 12521 52 1 1
QUERY_FILE_INFORMATION 12521
WriteX 12521 0 53 53
Close 12521
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12522
Close 12522
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12523
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12520 0 8192 8192
ReadX 12520 8192 4096 4096
ReadX 12520 12288 4096 4096
WriteX 12523 12005 1 1
QUERY_FILE_INFORMATION 12523
WriteX 12523 0 12006 12006
Close 12523
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 12524
ReadX 12524 0 4096 4096
WriteX 12524 0 4096 4096
Close 12524
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 12525
Close 12525
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12526
ReadX 12526 0 4096 4096
WriteX 12519 0 19054 19054
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 12527
Close 12527
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 12520
ReadX 12526 0 4096 4096
ReadX 12526 4096 4096 4096
ReadX 12526 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12528
WriteX 12528 11990 1 1
QUERY_FILE_INFORMATION 12528
WriteX 12528 0 11991 11991
Close 12528
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 12529
ReadX 12529 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 12526
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12530
Close 12530
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12531
ReadX 12531 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 12532
Close 12532
WriteX 12529 0 4096 4096
Close 12529
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 12533
Close 12533
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12534
ReadX 12534 0 4096 4096
ReadX 12534 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12535
Close 12535
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 12534 0 8192 8192
ReadX 12534 8192 3799 3799
WriteX 12534 13247 1 1
QUERY_FILE_INFORMATION 12534
WriteX 12534 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12534 0 8192 8192
ReadX 12534 8192 4096 4096
Close 12516
Close 12519
WriteX 12534 0 12288 12288
Close 12534
Close 12531
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12536
Close 12536
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12537
Close 12537
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12538
ReadX 12538 61440 4096 4096
ReadX 12538 126976 4096 4096
WriteX 12538 0 65471 65471
WriteX 12538 65471 65 65
WriteX 12538 65536 65471 65471
WriteX 12538 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12539
ReadX 12539 61440 4096 4096
ReadX 12539 126976 4096 4096
ReadX 12539 192512 4096 4096
ReadX 12539 258048 4096 4096
WriteX 12539 0 65471 65471
WriteX 12539 65471 65 65
WriteX 12539 65536 65471 65471
WriteX 12539 131007 65 65
WriteX 12539 131072 65471 65471
WriteX 12539 196543 65 65
WriteX 12539 196608 65471 65471
WriteX 12539 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12540
ReadX 12540 61440 4096 4096
ReadX 12540 126976 4096 4096
ReadX 12540 192512 4096 4096
ReadX 12540 258048 4096 4096
ReadX 12540 323584 4096 4096
ReadX 12540 389120 4096 4096
ReadX 12540 454656 4096 4096
ReadX 12540 520192 4096 4096
WriteX 12540 0 65471 65471
WriteX 12540 65471 65 65
WriteX 12540 65536 65471 65471
WriteX 12540 131007 65 65
WriteX 12540 131072 65471 65471
WriteX 12540 196543 65 65
WriteX 12540 196608 65471 65471
WriteX 12540 262079 65 65
WriteX 12540 262144 65471 65471
WriteX 12540 327615 65 65
WriteX 12540 327680 65471 65471
WriteX 12540 393151 65 65
WriteX 12540 393216 65471 65471
WriteX 12540 458687 65 65
WriteX 12540 458752 65471 65471
WriteX 12540 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12541
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12541 0 4096 4096
Close 12541
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12542
ReadX 12542 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12542
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12543
ReadX 12543 0 4096 4096
ReadX 12543 4096 4096 4096
ReadX 12543 8192 4096 4096
ReadX 12543 12288 4096 4096
ReadX 12543 16384 4096 4096
ReadX 12543 20480 4096 4096
ReadX 12543 24576 4096 4096
ReadX 12543 28672 4096 4096
ReadX 12543 32768 4096 4096
ReadX 12543 36864 4096 4096
ReadX 12543 40960 4096 4096
ReadX 12543 45056 4096 4096
ReadX 12543 49152 4096 4096
ReadX 12543 53248 4096 4096
ReadX 12543 57344 4096 4096
ReadX 12543 61440 4096 4096
ReadX 12543 65536 4096 4096
ReadX 12543 69632 4096 4096
ReadX 12543 73728 4096 4096
WriteX 12543 0 4096 4096
Close 12543
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12544
Close 12544
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12545
ReadX 12545 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12546
Close 12546
Close 12538
Close 12539
Close 12540
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12545
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12548
WriteX 12548 4607 1 1
QUERY_FILE_INFORMATION 12548
WriteX 12548 0 65471 65471
WriteX 12548 65471 65 65
WriteX 12548 65536 19979 19979
Close 12548
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12549
ReadX 12549 0 4096 4096
WriteX 12549 0 4096 4096
Flush 12549
WriteX 12549 0 4096 4096
Flush 12549
QUERY_FILE_INFORMATION 12549
WriteX 12549 0 4096 4096
Flush 12549
WriteX 12549 0 4096 4096
Flush 12549
WriteX 12549 0 4096 4096
Flush 12549
WriteX 12549 0 4096 4096
Flush 12549
Close 12549
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12550
ReadX 12550 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 12551
ReadX 12551 0 4096 4096
Close 12550
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12552
ReadX 12552 0 4096 4096
Close 12552
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12553
ReadX 12553 0 4096 4096
Close 12553
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12554
ReadX 12554 0 4096 4096
WriteX 12554 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 12555
Close 12555
Close 12551
Close 12554
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12556
Close 12556
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12558
WriteX 12558 4607 1 1
QUERY_FILE_INFORMATION 12558
WriteX 12558 0 65471 65471
WriteX 12558 65471 65 65
WriteX 12558 65536 17654 17654
Close 12558
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12559
ReadX 12559 0 4096 4096
WriteX 12559 0 4096 4096
Flush 12559
WriteX 12559 0 4096 4096
Flush 12559
QUERY_FILE_INFORMATION 12559
WriteX 12559 0 4096 4096
Flush 12559
WriteX 12559 0 4096 4096
Flush 12559
WriteX 12559 0 4096 4096
Flush 12559
WriteX 12559 0 4096 4096
Flush 12559
Close 12559
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12560
Close 12560
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12561
ReadX 12561 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 12562
Close 12562
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 12563
ReadX 12563 0 4096 4096
ReadX 12563 4096 4096 4096
ReadX 12563 8192 4096 4096
ReadX 12563 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12563 16384 4096 4096
ReadX 12563 20480 4096 4096
ReadX 12563 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 12561
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12564
ReadX 12564 0 4096 4096
Close 12564
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12565
ReadX 12565 0 4096 4096
Close 12565
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12566
ReadX 12566 0 4096 4096
WriteX 12566 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 12567
Close 12567
Close 12566
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12568
Close 12568
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12570
WriteX 12570 4607 1 1
QUERY_FILE_INFORMATION 12570
WriteX 12570 0 65471 65471
WriteX 12570 65471 65 65
WriteX 12570 65536 19490 19490
Close 12570
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12571
ReadX 12571 0 4096 4096
WriteX 12571 0 4096 4096
Flush 12571
WriteX 12571 0 4096 4096
Flush 12571
QUERY_FILE_INFORMATION 12571
WriteX 12571 0 4096 4096
Flush 12571
WriteX 12571 0 4096 4096
Flush 12571
WriteX 12571 0 4096 4096
Flush 12571
WriteX 12571 0 4096 4096
Flush 12571
Close 12571
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12572
Close 12572
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12573
ReadX 12573 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 12574
Close 12574
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12573
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12575
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12575 0 4096 4096
Close 12575
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12576
ReadX 12576 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12576
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12577
ReadX 12577 0 4096 4096
ReadX 12577 4096 4096 4096
ReadX 12577 8192 4096 4096
ReadX 12577 12288 4096 4096
ReadX 12577 16384 4096 4096
ReadX 12577 20480 4096 4096
ReadX 12577 24576 4096 4096
ReadX 12577 28672 4096 4096
ReadX 12577 32768 4096 4096
ReadX 12577 36864 4096 4096
ReadX 12577 40960 4096 4096
ReadX 12577 45056 4096 4096
ReadX 12577 49152 4096 4096
ReadX 12577 53248 4096 4096
ReadX 12577 57344 4096 4096
ReadX 12577 61440 4096 4096
ReadX 12577 65536 4096 4096
ReadX 12577 69632 4096 4096
ReadX 12577 73728 4096 4096
WriteX 12577 0 4096 4096
Close 12577
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12578
Close 12578
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12579
ReadX 12579 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12580
Close 12580
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12579
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12582
WriteX 12582 4607 1 1
QUERY_FILE_INFORMATION 12582
WriteX 12582 0 65471 65471
WriteX 12582 65471 65 65
WriteX 12582 65536 8866 8866
Close 12582
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12583
ReadX 12583 0 4096 4096
WriteX 12583 0 4096 4096
Flush 12583
WriteX 12583 0 4096 4096
Flush 12583
Close 12583
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12584
ReadX 12584 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12584
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12585
ReadX 12585 0 4096 4096
Close 12585
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12586
ReadX 12586 0 4096 4096
Close 12586
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12587
ReadX 12587 0 4096 4096
WriteX 12587 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 12588
Close 12588
Close 12587
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12589
Close 12589
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12591
WriteX 12591 4607 1 1
QUERY_FILE_INFORMATION 12591
WriteX 12591 0 65471 65471
WriteX 12591 65471 65 65
WriteX 12591 65536 9298 9298
Close 12591
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12592
ReadX 12592 0 4096 4096
WriteX 12592 0 4096 4096
Flush 12592
WriteX 12592 0 4096 4096
Flush 12592
Close 12592
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12593
Close 12593
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12594
ReadX 12594 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 12595
Close 12595
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12597
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12597 0 4096 4096
Close 12597
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12598
ReadX 12598 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12598 4096 4096 4096
ReadX 12598 8192 4096 4096
ReadX 12598 12288 4096 4096
ReadX 12598 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 12594
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12599
ReadX 12599 0 4096 4096
Close 12599
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12600
ReadX 12600 0 4096 4096
Close 12600
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12601
ReadX 12601 0 4096 4096
WriteX 12601 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 12602
Close 12602
Close 12598
Close 12601
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12603
Close 12603
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12605
WriteX 12605 4607 1 1
QUERY_FILE_INFORMATION 12605
WriteX 12605 0 65471 65471
WriteX 12605 65471 65 65
WriteX 12605 65536 11540 11540
Close 12605
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12606
ReadX 12606 0 4096 4096
WriteX 12606 0 4096 4096
Flush 12606
WriteX 12606 0 4096 4096
Flush 12606
Close 12606
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12607
Close 12607
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12608
ReadX 12608 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 12609
Close 12609
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12608
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12610
ReadX 12610 0 65471 65471
ReadX 12610 65471 65 65
ReadX 12610 65536 65471 65471
ReadX 12610 131007 65 65
ReadX 12610 131072 65471 65471
ReadX 12610 196543 65 65
ReadX 12610 196608 65471 65471
ReadX 12610 262079 65 65
ReadX 12610 262144 65471 65471
ReadX 12610 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12611
ReadX 12611 0 65471 65471
ReadX 12611 65471 65 65
ReadX 12611 65536 65471 65471
ReadX 12611 131007 65 65
ReadX 12611 131072 65471 65471
ReadX 12611 196543 65 65
ReadX 12611 196608 65471 65471
ReadX 12611 262079 65 65
ReadX 12611 262144 65471 65471
ReadX 12611 327615 65 65
ReadX 12611 327680 65471 65471
ReadX 12611 393151 65 65
ReadX 12611 393216 65471 65471
ReadX 12611 458687 65 65
ReadX 12611 458752 65471 65471
ReadX 12611 524223 65 65
ReadX 12611 524288 65471 65471
ReadX 12611 589759 65 65
ReadX 12611 589824 65471 65471
ReadX 12611 655295 65 65
ReadX 12611 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12612
ReadX 12612 0 65471 65471
ReadX 12612 65471 65 65
ReadX 12612 65536 65471 65471
ReadX 12612 131007 65 65
ReadX 12612 131072 65471 65471
ReadX 12612 196543 65 65
ReadX 12612 196608 65471 65471
ReadX 12612 262079 65 65
ReadX 12612 262144 65471 65471
ReadX 12612 327615 65 65
ReadX 12612 327680 65471 65471
ReadX 12612 393151 65 65
ReadX 12612 393216 65471 65471
ReadX 12612 458687 65 65
ReadX 12612 458752 65471 65471
ReadX 12612 524223 65 65
ReadX 12612 524288 65471 65471
ReadX 12612 589759 65 65
ReadX 12612 589824 65471 65471
ReadX 12612 655295 65 65
ReadX 12612 655360 65471 65471
ReadX 12612 720831 65 65
ReadX 12612 720896 65471 65471
ReadX 12612 786367 65 65
ReadX 12612 786432 65471 65471
ReadX 12612 851903 65 65
ReadX 12612 851968 65471 65471
ReadX 12612 917439 65 65
ReadX 12612 917504 65471 65471
ReadX 12612 982975 65 65
ReadX 12612 983040 65471 65471
ReadX 12612 1048511 65 65
ReadX 12612 1048576 65471 65471
ReadX 12612 1114047 65 65
ReadX 12612 1114112 65471 65471
ReadX 12612 1179583 65 65
ReadX 12612 1179648 65471 65471
ReadX 12612 1245119 65 65
ReadX 12612 1245184 65471 65471
ReadX 12612 1310655 65 65
ReadX 12612 1310720 65471 65471
ReadX 12612 1376191 65 65
ReadX 12612 1376256 65471 65471
ReadX 12612 1441727 65 65
ReadX 12612 1441792 65471 65471
ReadX 12612 1507263 65 65
ReadX 12612 1507328 65471 65471
ReadX 12612 1572799 65 65
ReadX 12612 1572864 65471 65471
ReadX 12612 1638335 65 65
ReadX 12612 1638400 65471 65471
ReadX 12612 1703871 65 65
ReadX 12612 1703936 65471 65471
ReadX 12612 1769407 65 65
ReadX 12612 1769472 65471 65471
ReadX 12612 1834943 65 65
ReadX 12612 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12613
FIND_FIRST \clients\client1\~dmtmp\*
Close 12613
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12614
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12615
QUERY_FILE_INFORMATION 12615
QUERY_FILE_INFORMATION 12615
QUERY_FILE_INFORMATION 12615
ReadX 12615 2156 24 24
ReadX 12615 2139 276 276
ReadX 12615 2136 14 14
ReadX 12615 2136 7 7
ReadX 12615 2138 12 12
ReadX 12615 2137 8 8
ReadX 12615 2135 15 15
ReadX 12615 0 16 16
ReadX 12615 16 2048 2048
ReadX 12615 2064 2048 2048
ReadX 12615 257 2048 2048
ReadX 12615 385 2048 2048
ReadX 12615 513 2048 2048
ReadX 12615 641 2048 2048
ReadX 12615 769 2048 2048
ReadX 12615 897 2048 2048
ReadX 12615 1025 2048 2048
ReadX 12615 1153 2048 2048
ReadX 12615 1281 2048 2048
ReadX 12615 1409 2048 2048
ReadX 12615 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12617
Close 12617
Close 12563
Close 12610
Close 12611
Close 12612
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12619
WriteX 12619 15 1 1
QUERY_FILE_INFORMATION 12619
WriteX 12619 0 10575 10575
Flush 12619
Close 12619
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12620
Close 12620
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12621
ReadX 12621 0 4096 4096
Close 12615
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12622
Close 12622
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12623
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12624
QUERY_FILE_INFORMATION 12624
ReadX 12624 0 512 512
ReadX 12624 512 512 512
ReadX 12624 1024 512 512
QUERY_FILE_INFORMATION 12624
QUERY_FILE_INFORMATION 12624
Close 12624
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12625
QUERY_FILE_INFORMATION 12625
ReadX 12625 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12626
QUERY_FILE_INFORMATION 12626
ReadX 12626 0 512 512
ReadX 12626 512 512 512
ReadX 12626 1024 512 512
ReadX 12626 288 20 20
ReadX 12626 308 2084 2084
ReadX 12626 388 2084 2084
ReadX 12626 388 2084 2084
ReadX 12614 2157 1386 1386
ReadX 12626 2472 399 399
ReadX 12626 3072 1536 1536
ReadX 12626 544 149 149
ReadX 12626 693 485 485
Close 12626
ReadX 12614 2157 4096 4096
ReadX 12614 6253 4096 4096
ReadX 12614 10349 4096 4096
ReadX 12614 14445 4096 4096
ReadX 12614 18541 4096 4096
ReadX 12614 22637 256 256
ReadX 12614 22893 4096 4096
ReadX 12614 26989 4096 4096
ReadX 12614 31085 4096 4096
ReadX 12614 35181 4096 4096
ReadX 12614 39277 4096 4096
ReadX 12614 43373 4096 4096
ReadX 12614 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12614 2157 1024 1024
ReadX 12614 1667 4688 4688
ReadX 12614 6355 3516 3516
ReadX 12614 9871 16384 16384
ReadX 12614 26255 3771 3771
ReadX 12614 30026 2048 2048
ReadX 12614 32074 1024 1024
ReadX 12614 33098 6652 6652
ReadX 12614 39750 16384 16384
ReadX 12614 56134 10496 10496
ReadX 12614 66630 1784 1784
ReadX 12614 68414 90 90
ReadX 12614 68504 273 273
ReadX 12614 68777 1600 1600
ReadX 12614 70377 640 640
ReadX 12614 71017 1280 1280
ReadX 12614 72297 8464 8464
ReadX 12614 80761 158 158
ReadX 12614 80919 912 912
ReadX 12614 81831 1980 1980
ReadX 12614 83811 2256 2256
ReadX 12614 86067 400 400
ReadX 12614 86467 252 252
ReadX 12614 86719 42 42
ReadX 12614 86761 725 725
ReadX 12614 2009 512 512
ReadX 12614 3895 9 9
ReadX 12614 3781 46 46
ReadX 12614 4059 92 92
ReadX 12614 3781 92 92
ReadX 12614 3986 184 184
ReadX 12614 3987 16384 16384
ReadX 12614 3902 16384 16384
ReadX 12614 3781 10240 10240
ReadX 12614 3821 16384 16384
ReadX 12614 3891 935 935
ReadX 12614 4060 10240 10240
ReadX 12614 4059 184 184
ReadX 12614 256 184 184
ReadX 12614 256 1026 1026
ReadX 12614 3901 326 326
ReadX 12614 3899 652 652
ReadX 12614 256 2 2
ReadX 12614 258 4948 4948
Close 12614
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12628
Close 12628
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12630
WriteX 12630 4055 1 1
QUERY_FILE_INFORMATION 12630
WriteX 12630 0 65471 65471
WriteX 12630 65471 65 65
WriteX 12630 65536 65471 65471
WriteX 12630 131007 65 65
WriteX 12630 131072 65471 65471
WriteX 12630 196543 65 65
WriteX 12630 196608 65471 65471
WriteX 12630 262079 65 65
WriteX 12630 262144 65471 65471
WriteX 12630 327615 65 65
WriteX 12630 327680 65471 65471
WriteX 12630 393151 65 65
WriteX 12630 393216 65471 65471
WriteX 12630 458687 65 65
WriteX 12630 458752 65471 65471
WriteX 12630 524223 65 65
WriteX 12630 524288 65471 65471
WriteX 12630 589759 65 65
WriteX 12630 589824 35257 35257
Close 12630
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12632
Close 12632
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12634
WriteX 12634 4055 1 1
QUERY_FILE_INFORMATION 12634
WriteX 12634 0 65471 65471
WriteX 12634 65471 65 65
WriteX 12634 65536 65471 65471
WriteX 12634 131007 65 65
WriteX 12634 131072 65471 65471
WriteX 12634 196543 65 65
WriteX 12634 196608 65471 65471
WriteX 12634 262079 65 65
WriteX 12634 262144 65471 65471
WriteX 12634 327615 65 65
WriteX 12634 327680 65471 65471
WriteX 12634 393151 65 65
WriteX 12634 393216 65471 65471
WriteX 12634 458687 65 65
WriteX 12634 458752 65471 65471
WriteX 12634 524223 65 65
WriteX 12634 524288 65471 65471
WriteX 12634 589759 65 65
WriteX 12634 589824 57598 57598
Close 12634
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12636
WriteX 12636 15 1 1
QUERY_FILE_INFORMATION 12636
WriteX 12636 0 12543 12543
Flush 12636
Close 12636
Close 12621
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12637
Close 12637
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12638
ReadX 12638 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12639
FIND_FIRST \clients\client1\~dmtmp\*
Close 12639
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12640
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12641
QUERY_FILE_INFORMATION 12641
QUERY_FILE_INFORMATION 12641
QUERY_FILE_INFORMATION 12641
ReadX 12641 1938 24 24
ReadX 12641 1920 276 276
ReadX 12641 1918 14 14
ReadX 12641 1918 7 7
ReadX 12641 1919 12 12
ReadX 12641 1919 8 8
ReadX 12641 1917 15 15
ReadX 12641 0 16 16
ReadX 12641 16 2048 2048
ReadX 12641 2064 2048 2048
ReadX 12641 257 2048 2048
ReadX 12641 385 2048 2048
ReadX 12641 513 2048 2048
ReadX 12641 641 2048 2048
ReadX 12641 769 2048 2048
ReadX 12641 897 2048 2048
ReadX 12641 1025 2048 2048
ReadX 12641 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12643
Close 12643
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12645
WriteX 12645 15 1 1
QUERY_FILE_INFORMATION 12645
WriteX 12645 0 11588 11588
Flush 12645
Close 12645
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12646
Close 12646
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12647
ReadX 12647 0 4096 4096
Close 12641
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12649
WriteX 12649 15 1 1
QUERY_FILE_INFORMATION 12649
WriteX 12649 0 11615 11615
Flush 12649
Close 12649
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12647
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12650
Close 12650
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12651
ReadX 12651 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12653
Close 12653
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12655
WriteX 12655 4088 1 1
QUERY_FILE_INFORMATION 12655
WriteX 12655 0 65471 65471
WriteX 12655 65471 65 65
WriteX 12655 65536 16050 16050
Close 12655
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12640 1939 64 64
ReadX 12640 128 248 248
ReadX 12640 128 568 568
ReadX 12640 3872 1536 1536
ReadX 12640 3456 2560 2560
ReadX 12640 3136 512 512
ReadX 12640 2880 4096 4096
ReadX 12640 3264 3072 3072
ReadX 12640 320 4096 4096
ReadX 12640 1024 4096 4096
ReadX 12640 3616 4096 4096
ReadX 12640 1939 64 64
ReadX 12640 128 248 248
ReadX 12640 128 608 608
ReadX 12640 2858 1024 1024
ReadX 12640 2810 4096 4096
ReadX 12640 2826 4096 4096
ReadX 12640 2580 2048 2048
ReadX 12640 2800 2560 2560
ReadX 12640 2100 4096 4096
ReadX 12640 2084 4096 4096
ReadX 12640 868 4096 4096
ReadX 12640 2324 4096 4096
ReadX 12640 884 4096 4096
ReadX 12640 2604 1024 1024
ReadX 12640 580 4096 4096
ReadX 12640 596 4096 4096
ReadX 12640 2752 4096 4096
ReadX 12640 2842 1024 1024
ReadX 12640 660 4096 4096
ReadX 12640 2720 4096 4096
ReadX 12640 2736 4096 4096
ReadX 12640 628 4096 4096
ReadX 12640 2704 4096 4096
ReadX 12640 1556 4096 4096
ReadX 12640 576 4096 4096
ReadX 12640 3168 1536 1536
ReadX 12640 832 4096 4096
ReadX 12640 1088 4096 4096
ReadX 12640 1344 4096 4096
ReadX 12640 1600 4096 4096
ReadX 12640 1856 4096 4096
ReadX 12640 2112 4096 4096
ReadX 12640 1892 4096 4096
ReadX 12640 820 4096 4096
ReadX 12640 788 4096 4096
ReadX 12640 1604 4096 4096
ReadX 12640 3648 4096 4096
ReadX 12640 2608 4096 4096
ReadX 12640 548 4096 4096
ReadX 12640 740 4096 4096
ReadX 12640 1344 4096 4096
ReadX 12640 3392 4096 4096
ReadX 12640 3904 4096 4096
ReadX 12640 644 4096 4096
ReadX 12640 676 4096 4096
ReadX 12640 2688 4096 4096
ReadX 12640 320 4096 4096
ReadX 12640 900 4096 4096
ReadX 12640 1908 4096 4096
ReadX 12640 852 4096 4096
ReadX 12640 724 4096 4096
ReadX 12640 2292 4096 4096
ReadX 12640 612 4096 4096
ReadX 12640 388 4096 4096
ReadX 12640 2368 4096 4096
ReadX 12640 2624 4096 4096
ReadX 12640 500 4096 4096
ReadX 12640 356 4096 4096
ReadX 12640 1024 4096 4096
ReadX 12640 576 4096 4096
ReadX 12640 340 4096 4096
ReadX 12640 420 4096 4096
ReadX 12640 1600 4096 4096
ReadX 12640 404 4096 4096
ReadX 12640 1428 4096 4096
ReadX 12640 2656 4096 4096
ReadX 12640 2624 4096 4096
ReadX 12640 452 4096 4096
ReadX 12640 692 4096 4096
ReadX 12640 564 4096 4096
ReadX 12640 372 4096 4096
ReadX 12640 468 4096 4096
ReadX 12640 484 4096 4096
ReadX 12640 1088 4096 4096
ReadX 12640 1924 4096 4096
ReadX 12640 2768 4096 4096
ReadX 12640 832 4096 4096
ReadX 12640 836 4096 4096
ReadX 12640 1856 4096 4096
ReadX 12640 2640 4096 4096
ReadX 12640 436 4096 4096
ReadX 12640 1828 4096 4096
ReadX 12640 804 4096 4096
ReadX 12640 1860 4096 4096
ReadX 12640 1812 4096 4096
ReadX 12640 756 4096 4096
ReadX 12640 1636 4096 4096
ReadX 12640 772 4096 4096
ReadX 12640 2036 4096 4096
ReadX 12640 1220 4096 4096
ReadX 12640 1652 4096 4096
ReadX 12640 2588 4096 4096
ReadX 12640 916 4096 4096
ReadX 12640 260 4096 4096
ReadX 12640 932 4096 4096
ReadX 12640 2624 4096 4096
ReadX 12640 308 4096 4096
ReadX 12640 292 4096 4096
ReadX 12640 1140 4096 4096
ReadX 12640 276 4096 4096
ReadX 12640 2020 4096 4096
ReadX 12640 2880 4096 4096
ReadX 12640 516 4096 4096
ReadX 12640 1844 4096 4096
ReadX 12640 1124 4096 4096
ReadX 12640 3136 4096 4096
ReadX 12640 324 4096 4096
ReadX 12640 1156 4096 4096
ReadX 12640 1172 4096 4096
ReadX 12640 2112 4096 4096
ReadX 12640 2368 4096 4096
ReadX 12640 964 4096 4096
ReadX 12640 980 4096 4096
ReadX 12640 1012 4096 4096
ReadX 12640 532 4096 4096
ReadX 12640 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12640 1620 4096 4096
ReadX 12640 1604 4096 4096
ReadX 12640 2116 4096 4096
ReadX 12640 2132 4096 4096
ReadX 12640 2148 4096 4096
ReadX 12640 2276 4096 4096
ReadX 12640 1540 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12657
Close 12657
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12659
QUERY_FILE_INFORMATION 12623
Close 12623
WriteX 12659 4088 1 1
QUERY_FILE_INFORMATION 12659
QUERY_FILE_INFORMATION 12625
Close 12625
WriteX 12659 0 65471 65471
WriteX 12659 65471 65 65
WriteX 12659 65536 64850 64850
Close 12659
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12661
WriteX 12661 15 1 1
QUERY_FILE_INFORMATION 12661
ReadX 12640 2068 4096 4096
ReadX 12640 1588 4096 4096
ReadX 12640 1572 4096 4096
WriteX 12661 0 18630 18630
Flush 12661
Close 12661
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12651
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12662
Close 12662
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12663
ReadX 12663 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 12640 612 4096 4096
ReadX 12640 564 4096 4096
ReadX 12640 1876 4096 4096
ReadX 12640 628 4096 4096
ReadX 12640 740 4096 4096
ReadX 12640 724 4096 4096
ReadX 12640 644 4096 4096
ReadX 12640 2324 4096 4096
ReadX 12640 660 4096 4096
ReadX 12640 852 4096 4096
ReadX 12640 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 12640 2368 4096 4096
ReadX 12640 1024 4096 4096
ReadX 12640 320 4096 4096
ReadX 12640 580 4096 4096
ReadX 12640 3136 512 512
ReadX 12640 2880 4096 4096
Close 12640
Close 12663
Close 12638
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12664
ReadX 12664 61440 4096 4096
ReadX 12664 126976 4096 4096
WriteX 12664 0 65471 65471
WriteX 12664 65471 65 65
WriteX 12664 65536 65471 65471
WriteX 12664 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12665
ReadX 12665 61440 4096 4096
ReadX 12665 126976 4096 4096
ReadX 12665 192512 4096 4096
ReadX 12665 258048 4096 4096
WriteX 12665 0 65471 65471
WriteX 12665 65471 65 65
WriteX 12665 65536 65471 65471
WriteX 12665 131007 65 65
WriteX 12665 131072 65471 65471
WriteX 12665 196543 65 65
WriteX 12665 196608 65471 65471
WriteX 12665 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12666
ReadX 12666 61440 4096 4096
ReadX 12666 126976 4096 4096
ReadX 12666 192512 4096 4096
ReadX 12666 258048 4096 4096
ReadX 12666 323584 4096 4096
ReadX 12666 389120 4096 4096
ReadX 12666 454656 4096 4096
ReadX 12666 520192 4096 4096
WriteX 12666 0 65471 65471
WriteX 12666 65471 65 65
WriteX 12666 65536 65471 65471
WriteX 12666 131007 65 65
WriteX 12666 131072 65471 65471
WriteX 12666 196543 65 65
WriteX 12666 196608 65471 65471
WriteX 12666 262079 65 65
WriteX 12666 262144 65471 65471
WriteX 12666 327615 65 65
WriteX 12666 327680 65471 65471
WriteX 12666 393151 65 65
WriteX 12666 393216 65471 65471
WriteX 12666 458687 65 65
WriteX 12666 458752 65471 65471
WriteX 12666 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12667
Close 12667
Close 12664
Close 12665
Close 12666
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12668
Close 12668
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 12671
Close 12671
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 12673
Close 12673
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 12674
Close 12674
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12677
Close 12677
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12679
Close 12679
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12680
Close 12680
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12683
Close 12683
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12687
Close 12687
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12691
Close 12691
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12695
Close 12695
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12699
Close 12699
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12703
Close 12703
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12707
Close 12707
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12711
Close 12711
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12713
Close 12713
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12715
Close 12715
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12717
WriteX 12717 4095 1 1
QUERY_FILE_INFORMATION 12717
QUERY_FS_INFORMATION 259
WriteX 12717 0 65471 65471
WriteX 12717 65471 65 65
WriteX 12717 65536 65471 65471
WriteX 12717 131007 65 65
WriteX 12717 131072 65471 65471
WriteX 12717 196543 65 65
WriteX 12717 196608 65471 65471
WriteX 12717 262079 65 65
WriteX 12717 262144 26634 26634
Close 12717
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12722
Close 12722
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12723
Close 12723
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12724
ReadX 12724 0 4096 4096
Close 12724
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12725
ReadX 12725 0 4096 4096
ReadX 12725 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12726
Close 12726
Close 12725
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12729
Close 12729
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12731
Close 12731
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12732
Close 12732
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12735
Close 12735
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12737
Close 12737
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12738
Close 12738
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12741
Close 12741
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12745
Close 12745
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12749
Close 12749
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12753
Close 12753
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12757
Close 12757
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12761
Close 12761
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12764
Close 12764
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12768
Close 12768
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12772
Close 12772
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 12774
Close 12774
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 12775
Close 12775
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12784
Close 12784
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12785
FIND_FIRST \clients\client1\~dmtmp\*
Close 12785
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12786
Close 12786
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12787
ReadX 12787 0 4096 4096
Close 12787
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12788
ReadX 12788 0 4096 4096
Close 12788
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12789
ReadX 12789 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12799
Close 12799
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12800
FIND_FIRST \clients\client1\~dmtmp\*
Close 12800
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12801
Close 12801
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12802
ReadX 12802 0 4096 4096
Close 12802
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12803
ReadX 12803 0 4096 4096
Close 12803
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12804
ReadX 12804 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12805
ReadX 12805 0 65471 65471
ReadX 12805 65471 65 65
ReadX 12805 65536 65471 65471
ReadX 12805 131007 65 65
ReadX 12805 131072 65471 65471
ReadX 12805 196543 65 65
ReadX 12805 196608 65471 65471
ReadX 12805 262079 65 65
ReadX 12805 262144 65471 65471
ReadX 12805 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12806
ReadX 12806 0 65471 65471
ReadX 12806 65471 65 65
ReadX 12806 65536 65471 65471
ReadX 12806 131007 65 65
ReadX 12806 131072 65471 65471
ReadX 12806 196543 65 65
ReadX 12806 196608 65471 65471
ReadX 12806 262079 65 65
ReadX 12806 262144 65471 65471
ReadX 12806 327615 65 65
ReadX 12806 327680 65471 65471
ReadX 12806 393151 65 65
ReadX 12806 393216 65471 65471
ReadX 12806 458687 65 65
ReadX 12806 458752 65471 65471
ReadX 12806 524223 65 65
ReadX 12806 524288 65471 65471
ReadX 12806 589759 65 65
ReadX 12806 589824 65471 65471
ReadX 12806 655295 65 65
ReadX 12806 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12807
ReadX 12807 0 65471 65471
ReadX 12807 65471 65 65
ReadX 12807 65536 65471 65471
ReadX 12807 131007 65 65
ReadX 12807 131072 65471 65471
ReadX 12807 196543 65 65
ReadX 12807 196608 65471 65471
ReadX 12807 262079 65 65
ReadX 12807 262144 65471 65471
ReadX 12807 327615 65 65
ReadX 12807 327680 65471 65471
ReadX 12807 393151 65 65
ReadX 12807 393216 65471 65471
ReadX 12807 458687 65 65
ReadX 12807 458752 65471 65471
ReadX 12807 524223 65 65
ReadX 12807 524288 65471 65471
ReadX 12807 589759 65 65
ReadX 12807 589824 65471 65471
ReadX 12807 655295 65 65
ReadX 12807 655360 65471 65471
ReadX 12807 720831 65 65
ReadX 12807 720896 65471 65471
ReadX 12807 786367 65 65
ReadX 12807 786432 65471 65471
ReadX 12807 851903 65 65
ReadX 12807 851968 65471 65471
ReadX 12807 917439 65 65
ReadX 12807 917504 65471 65471
ReadX 12807 982975 65 65
ReadX 12807 983040 65471 65471
ReadX 12807 1048511 65 65
ReadX 12807 1048576 65471 65471
ReadX 12807 1114047 65 65
ReadX 12807 1114112 65471 65471
ReadX 12807 1179583 65 65
ReadX 12807 1179648 65471 65471
ReadX 12807 1245119 65 65
ReadX 12807 1245184 65471 65471
ReadX 12807 1310655 65 65
ReadX 12807 1310720 65471 65471
ReadX 12807 1376191 65 65
ReadX 12807 1376256 65471 65471
ReadX 12807 1441727 65 65
ReadX 12807 1441792 65471 65471
ReadX 12807 1507263 65 65
ReadX 12807 1507328 65471 65471
ReadX 12807 1572799 65 65
ReadX 12807 1572864 65471 65471
ReadX 12807 1638335 65 65
ReadX 12807 1638400 65471 65471
ReadX 12807 1703871 65 65
ReadX 12807 1703936 65471 65471
ReadX 12807 1769407 65 65
ReadX 12807 1769472 65471 65471
ReadX 12807 1834943 65 65
ReadX 12807 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12808
ReadX 12808 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12808 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12808 8192 4096 4096
ReadX 12808 12288 4096 4096
ReadX 12808 16384 4096 4096
ReadX 12808 20480 4096 4096
ReadX 12808 24576 4096 4096
ReadX 12808 28672 4096 4096
ReadX 12808 32768 4096 4096
ReadX 12808 36864 4096 4096
ReadX 12808 40960 4096 4096
ReadX 12808 45056 4096 4096
ReadX 12808 49152 4096 4096
ReadX 12808 53248 4096 4096
ReadX 12808 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12808 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 12809
Close 12809
Close 12789
Close 12804
Close 12805
Close 12806
Close 12807
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 12810
WriteX 12810 1535 1 1
QUERY_FILE_INFORMATION 12810
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12808 0 4096 4096
ReadX 12808 4096 4096 4096
QUERY_FILE_INFORMATION 12810
WriteX 12810 0 57088 57088
WriteX 12810 0 4096 4096
Flush 12810
Close 12808
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12811
Close 12811
WriteX 12810 0 4096 4096
Close 12810
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 12812
Close 12812
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12813
ReadX 12813 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12813 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 12814
WriteX 12814 1535 1 1
QUERY_FILE_INFORMATION 12814
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12813 0 4096 4096
QUERY_FILE_INFORMATION 12814
WriteX 12814 0 51456 51456
WriteX 12814 0 4096 4096
Flush 12814
Close 12813
WriteX 12814 0 4096 4096
Close 12814
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 12815
Close 12815
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12816
ReadX 12816 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12816 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12818
Close 12818
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12820
WriteX 12820 4045 1 1
QUERY_FILE_INFORMATION 12820
WriteX 12820 0 53077 53077
Close 12820
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 12821
WriteX 12821 1535 1 1
QUERY_FILE_INFORMATION 12821
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12816 0 4096 4096
QUERY_FILE_INFORMATION 12821
WriteX 12821 0 65471 65471
WriteX 12821 65471 65 65
WriteX 12821 65536 1856 1856
WriteX 12821 0 4096 4096
Flush 12821
Close 12816
WriteX 12821 0 4096 4096
Close 12821
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 12822
Close 12822
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12823
ReadX 12823 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12825
Close 12825
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12827
WriteX 12827 4076 1 1
QUERY_FILE_INFORMATION 12827
WriteX 12827 0 7983 7983
Close 12827
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12829
Close 12829
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12831
WriteX 12831 4095 1 1
QUERY_FILE_INFORMATION 12831
WriteX 12831 0 65471 65471
WriteX 12831 65471 65 65
WriteX 12831 65536 65471 65471
WriteX 12831 131007 65 65
WriteX 12831 131072 65471 65471
WriteX 12831 196543 65 65
WriteX 12831 196608 65471 65471
WriteX 12831 262079 65 65
WriteX 12831 262144 65471 65471
WriteX 12831 327615 65 65
WriteX 12831 327680 65471 65471
WriteX 12831 393151 65 65
WriteX 12831 393216 65471 65471
WriteX 12831 458687 65 65
WriteX 12831 458752 46731 46731
Close 12831
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 12832
WriteX 12832 1535 1 1
QUERY_FILE_INFORMATION 12832
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12823 0 4096 4096
ReadX 12823 4096 4096 4096
QUERY_FILE_INFORMATION 12832
WriteX 12832 0 65471 65471
WriteX 12832 65471 65 65
WriteX 12832 65536 22848 22848
WriteX 12832 0 4096 4096
Flush 12832
Close 12823
WriteX 12832 0 4096 4096
Close 12832
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 12833
Close 12833
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12834
ReadX 12834 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12834 4096 4096 4096
Close 12834
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12835
ReadX 12835 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12835 0 8192 8192
ReadX 12835 8192 4096 4096
ReadX 12835 12288 4096 4096
ReadX 12835 16384 4096 4096
ReadX 12835 20480 4096 4096
ReadX 12835 24576 4096 4096
ReadX 12835 28672 4096 4096
ReadX 12835 32768 4096 4096
ReadX 12835 36864 4096 4096
ReadX 12835 40960 4096 4096
ReadX 12835 45056 4096 4096
ReadX 12835 49152 4096 4096
ReadX 12835 53248 4096 4096
ReadX 12835 57344 4096 4096
ReadX 12835 61440 4096 4096
ReadX 12835 65536 4096 4096
ReadX 12835 69632 4096 4096
ReadX 12835 73728 4096 4096
ReadX 12835 77824 4096 4096
ReadX 12835 81920 4096 4096
ReadX 12835 86016 4096 4096
ReadX 12835 90112 4096 4096
ReadX 12835 94208 4096 4096
ReadX 12835 98304 4096 4096
ReadX 12835 102400 4096 4096
ReadX 12835 106496 4096 4096
ReadX 12835 110592 4096 4096
ReadX 12835 114688 4096 4096
ReadX 12835 118784 4096 4096
ReadX 12835 122880 4096 4096
ReadX 12835 126976 4096 4096
ReadX 12835 131072 4096 4096
ReadX 12835 135168 4096 4096
ReadX 12835 139264 4096 4096
ReadX 12835 143360 4096 4096
ReadX 12835 147456 4096 4096
ReadX 12835 151552 4096 4096
ReadX 12835 155648 4096 4096
ReadX 12835 159744 4096 4096
ReadX 12835 163840 4096 4096
ReadX 12835 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12835 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 12836
Close 12836
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 12837
WriteX 12837 2047 1 1
QUERY_FILE_INFORMATION 12837
Close 12835
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12838
Close 12838
WriteX 12837 0 42388 42388
Close 12837
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 12839
Close 12839
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12840
ReadX 12840 0 4096 4096
ReadX 12840 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 12841
WriteX 12841 2047 1 1
QUERY_FILE_INFORMATION 12841
Close 12840
WriteX 12841 0 42652 42652
Close 12841
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 12842
Close 12842
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12843
ReadX 12843 0 4096 4096
ReadX 12843 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12845
Close 12845
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12847
WriteX 12847 4080 1 1
QUERY_FILE_INFORMATION 12847
WriteX 12847 0 65471 65471
WriteX 12847 65471 65 65
WriteX 12847 65536 49 49
Close 12847
Close 12843
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12848
ReadX 12848 61440 4096 4096
ReadX 12848 126976 4096 4096
WriteX 12848 0 65471 65471
WriteX 12848 65471 65 65
WriteX 12848 65536 65471 65471
WriteX 12848 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12849
ReadX 12849 61440 4096 4096
ReadX 12849 126976 4096 4096
ReadX 12849 192512 4096 4096
ReadX 12849 258048 4096 4096
WriteX 12849 0 65471 65471
WriteX 12849 65471 65 65
WriteX 12849 65536 65471 65471
WriteX 12849 131007 65 65
WriteX 12849 131072 65471 65471
WriteX 12849 196543 65 65
WriteX 12849 196608 65471 65471
WriteX 12849 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12850
ReadX 12850 61440 4096 4096
ReadX 12850 126976 4096 4096
ReadX 12850 192512 4096 4096
ReadX 12850 258048 4096 4096
ReadX 12850 323584 4096 4096
ReadX 12850 389120 4096 4096
ReadX 12850 454656 4096 4096
ReadX 12850 520192 4096 4096
WriteX 12850 0 65471 65471
WriteX 12850 65471 65 65
WriteX 12850 65536 65471 65471
WriteX 12850 131007 65 65
WriteX 12850 131072 65471 65471
WriteX 12850 196543 65 65
WriteX 12850 196608 65471 65471
WriteX 12850 262079 65 65
WriteX 12850 262144 65471 65471
WriteX 12850 327615 65 65
WriteX 12850 327680 65471 65471
WriteX 12850 393151 65 65
WriteX 12850 393216 65471 65471
WriteX 12850 458687 65 65
WriteX 12850 458752 65471 65471
WriteX 12850 524223 65 65
Close 12848
Close 12849
Close 12850
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12851
FIND_FIRST \clients\client1\~dmtmp\*
Close 12851
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12852
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12852 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12853
ReadX 12853 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12854
ReadX 12854 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12855
ReadX 12855 0 4096 4096
ReadX 12852 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12852
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12856
ReadX 12856 0 4096 4096
ReadX 12856 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12857
FIND_FIRST \clients\client1\~dmtmp\*
Close 12857
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 12858
QUERY_FILE_INFORMATION 12858
WriteX 12858 2047 1 1
QUERY_FILE_INFORMATION 12858
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 12859
Close 12859
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12860
WriteX 12860 52 1 1
QUERY_FILE_INFORMATION 12860
WriteX 12860 0 491 491
Close 12860
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12861
ReadX 12861 0 491 491
WriteX 12858 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 12856
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12862
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12862 0 4096 4096
ReadX 12862 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 12864
Close 12864
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12865
WriteX 12865 52 1 1
QUERY_FILE_INFORMATION 12865
WriteX 12865 0 543 543
Close 12865
Close 12862
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12866
ReadX 12866 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12867
ReadX 12867 0 543 543
ReadX 12866 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12866
Close 12861
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12867
Close 12853
Close 12854
Close 12855
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12858
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12868
FIND_FIRST \clients\client1\~dmtmp\*
Close 12868
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12869
ReadX 12869 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12870
ReadX 12870 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12871
ReadX 12871 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12872
ReadX 12872 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12873
ReadX 12873 0 543 543
ReadX 12869 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 12877
FIND_FIRST \clients\client1\~dmtmp\*
Close 12877
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12878
QUERY_FILE_INFORMATION 12878
WriteX 12878 2047 1 1
QUERY_FILE_INFORMATION 12878
WriteX 12878 0 2048 2048
Close 12878
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12879
ReadX 12879 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12879
Close 12869
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12880
ReadX 12880 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 12880 4095 1 1
QUERY_FILE_INFORMATION 12880
ReadX 12880 0 4096 4096
WriteX 12880 0 4096 4096
Flush 12880
WriteX 12880 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12881
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12881 0 4096 4096
ReadX 12881 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 12885
FIND_FIRST \clients\client1\~dmtmp\*
Close 12885
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12886
WriteX 12886 2047 1 1
QUERY_FILE_INFORMATION 12886
WriteX 12886 0 2048 2048
Close 12886
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12887
ReadX 12887 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 12891
Close 12891
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12892
WriteX 12892 2047 1 1
QUERY_FILE_INFORMATION 12892
WriteX 12892 0 2048 2048
Close 12892
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12893
ReadX 12893 0 2048 2048
ReadX 12881 4096 16384 16384
Close 12893
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12894
ReadX 12894 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 12894
Close 12873
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 12887 4095 1 1
QUERY_FILE_INFORMATION 12887
ReadX 12887 0 4096 4096
WriteX 12887 0 4096 4096
Close 12887
WriteX 12881 0 8192 8192
Close 12881
WriteX 12870 0 4096 4096
WriteX 12871 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12896
ReadX 12896 0 4096 4096
ReadX 12896 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12896
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12897
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12897 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12898
ReadX 12898 0 543 543
ReadX 12897 0 4096 4096
Close 12897
Close 12880
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12899
QUERY_FILE_INFORMATION 12899
Close 12899
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12898
Close 12870
Close 12871
Close 12872
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12900
FIND_FIRST \clients\client1\~dmtmp\*
Close 12900
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12901
ReadX 12901 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12902
ReadX 12902 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12903
ReadX 12903 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12904
ReadX 12904 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12905
ReadX 12905 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12906
ReadX 12906 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12907
ReadX 12907 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12908
ReadX 12908 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12909
ReadX 12909 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12910
ReadX 12910 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12911
ReadX 12911 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12912
ReadX 12912 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12913
ReadX 12913 0 4096 4096
ReadX 12901 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12917
FIND_FIRST \clients\client1\~dmtmp\*
Close 12917
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12918
QUERY_FILE_INFORMATION 12918
WriteX 12918 2047 1 1
QUERY_FILE_INFORMATION 12918
WriteX 12918 0 2048 2048
Close 12918
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12919
ReadX 12919 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12919
Close 12909
Close 12901
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12920
ReadX 12920 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12921
FIND_FIRST \clients\client1\~dmtmp\*
Close 12921
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12922
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12922 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12923
ReadX 12923 0 4096 4096
ReadX 12922 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12927
FIND_FIRST \clients\client1\~dmtmp\*
Close 12927
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12928
QUERY_FILE_INFORMATION 12928
WriteX 12928 2047 1 1
QUERY_FILE_INFORMATION 12928
WriteX 12928 0 2048 2048
Close 12928
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12929
ReadX 12929 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12929
Close 12922
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12930
ReadX 12930 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12920 4095 1 1
QUERY_FILE_INFORMATION 12920
ReadX 12920 0 4096 4096
WriteX 12920 0 4096 4096
Flush 12920
WriteX 12930 4095 1 1
QUERY_FILE_INFORMATION 12930
ReadX 12930 0 4096 4096
WriteX 12930 0 4096 4096
Flush 12930
WriteX 12920 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 12930 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12931
ReadX 12931 0 4096 4096
ReadX 12923 0 4096 4096
ReadX 12931 0 4096 4096
ReadX 12931 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12932
FIND_FIRST \clients\client1\~dmtmp\*
Close 12932
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12933
WriteX 12933 4095 1 1
QUERY_FILE_INFORMATION 12933
WriteX 12933 0 4096 4096
Close 12933
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12934
ReadX 12934 0 4096 4096
Close 12931
Close 12923
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12935
Close 12935
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12936
WriteX 12936 4095 1 1
QUERY_FILE_INFORMATION 12936
WriteX 12936 0 4096 4096
Close 12936
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12937
ReadX 12937 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 12937 0 4096 4096
Close 12934
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12913
Close 12907
Close 12910
Close 12911
Close 12912
Close 12908
Close 12902
Close 12905
Close 12906
Close 12903
Close 12904
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12937
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12939
Close 12939
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12940
ReadX 12940 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12941
Close 12941
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12942
WriteX 12942 2047 1 1
QUERY_FILE_INFORMATION 12942
WriteX 12942 0 2048 2048
Close 12942
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12943
ReadX 12943 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12943
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12944
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12944 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12945
ReadX 12945 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12946
ReadX 12946 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12947
ReadX 12947 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12948
ReadX 12948 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12949
ReadX 12949 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12950
ReadX 12950 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12951
ReadX 12951 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12952
ReadX 12952 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12953
ReadX 12953 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12954
ReadX 12954 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12955
ReadX 12955 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12956
ReadX 12956 0 4096 4096
ReadX 12944 0 4096 4096
ReadX 12951 0 4096 4096
Close 12951
Close 12944
Close 12920
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12957
QUERY_FILE_INFORMATION 12957
Close 12957
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12940
Close 12955
Close 12950
Close 12952
Close 12953
Close 12954
Close 12956
Close 12945
Close 12948
Close 12949
Close 12946
Close 12947
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12930
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12958
QUERY_FILE_INFORMATION 12958
Close 12958
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12959
FIND_FIRST \clients\client1\~dmtmp\*
Close 12959
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12960
ReadX 12960 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12961
ReadX 12961 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12962
ReadX 12962 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12963
ReadX 12963 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12964
ReadX 12964 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12965
ReadX 12965 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12966
ReadX 12966 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12967
ReadX 12967 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12968
ReadX 12968 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12969
ReadX 12969 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12970
ReadX 12970 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12971
ReadX 12971 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12972
ReadX 12972 0 4096 4096
ReadX 12960 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12976
FIND_FIRST \clients\client1\~dmtmp\*
Close 12976
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12977
QUERY_FILE_INFORMATION 12977
WriteX 12977 2047 1 1
QUERY_FILE_INFORMATION 12977
WriteX 12977 0 2048 2048
Close 12977
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12978
ReadX 12978 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12978
Close 12960
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12979
ReadX 12979 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12980
FIND_FIRST \clients\client1\~dmtmp\*
Close 12980
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12981
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12981 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12982
ReadX 12982 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12983
ReadX 12983 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12984
ReadX 12984 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12985
ReadX 12985 0 543 543
ReadX 12981 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12989
FIND_FIRST \clients\client1\~dmtmp\*
Close 12989
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12990
QUERY_FILE_INFORMATION 12990
WriteX 12990 2047 1 1
QUERY_FILE_INFORMATION 12990
WriteX 12990 0 2048 2048
Close 12990
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12991
ReadX 12991 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12991
Close 12981
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12992
ReadX 12992 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 12965
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12993
FIND_FIRST \clients\client1\~dmtmp\*
Close 12993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12994
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12994 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12995
ReadX 12995 0 4096 4096
ReadX 12994 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12999
FIND_FIRST \clients\client1\~dmtmp\*
Close 12999
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13000
QUERY_FILE_INFORMATION 13000
WriteX 13000 2047 1 1
QUERY_FILE_INFORMATION 13000
WriteX 13000 0 2048 2048
Close 13000
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13001
ReadX 13001 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13001
Close 12995
Close 12994
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13002
ReadX 13002 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12979 4095 1 1
QUERY_FILE_INFORMATION 12979
ReadX 12979 0 4096 4096
WriteX 12979 0 4096 4096
Flush 12979
WriteX 12992 4095 1 1
QUERY_FILE_INFORMATION 12992
ReadX 12992 0 4096 4096
WriteX 12992 0 4096 4096
Flush 12992
WriteX 13002 4095 1 1
QUERY_FILE_INFORMATION 13002
ReadX 13002 0 4096 4096
WriteX 13002 0 4096 4096
Flush 13002
WriteX 12979 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 12992 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 13002 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13003
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13003 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13004
ReadX 13004 0 4096 4096
ReadX 13003 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13005
ReadX 13005 0 4096 4096
ReadX 13005 0 4096 4096
ReadX 13005 4096 16384 16384
ReadX 13003 4096 16384 16384
ReadX 13003 0 4096 4096
ReadX 13004 0 4096 4096
ReadX 13004 4096 4096 4096
Close 13005
Close 13004
Close 13003
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13006
FIND_FIRST \clients\client1\~dmtmp\*
Close 13006
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13007
ReadX 13007 0 2048 2048
WriteX 13007 18431 1 1
QUERY_FILE_INFORMATION 13007
WriteX 13007 0 19584 19584
Close 13007
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13008
ReadX 13008 0 4096 4096
ReadX 13008 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13008
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13009
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13009 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13010
ReadX 13010 0 4096 4096
ReadX 13009 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13011
ReadX 13011 0 4096 4096
ReadX 13011 0 4096 4096
Close 13011
Close 13010
Close 13009
Close 12979
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13012
QUERY_FILE_INFORMATION 13012
Close 13012
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12985
Close 12972
Close 12964
Close 12982
Close 12983
Close 12984
Close 12971
Close 12966
Close 12969
Close 12970
Close 12967
Close 12968
Close 12961
Close 12962
Close 12963
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12992
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13013
QUERY_FILE_INFORMATION 13013
Close 13013
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13002
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13014
QUERY_FILE_INFORMATION 13014
Close 13014
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13015
FIND_FIRST \clients\client1\~dmtmp\*
Close 13015
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13016
ReadX 13016 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13017
ReadX 13017 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13018
ReadX 13018 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13019
ReadX 13019 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13020
ReadX 13020 0 543 543
ReadX 13016 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13016 4096 16384 16384
WriteX 13016 0 4096 4096
Close 13016
WriteX 13017 0 4096 4096
WriteX 13018 0 4096 4096
WriteX 13019 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13021
FIND_FIRST \clients\client1\~dmtmp\*
Close 13021
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13022
ReadX 13022 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13023
ReadX 13023 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13024
ReadX 13024 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13025
ReadX 13025 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13026
ReadX 13026 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13027
ReadX 13027 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13028
ReadX 13028 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13029
ReadX 13029 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13030
ReadX 13030 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13031
ReadX 13031 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13032
ReadX 13032 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13033
ReadX 13033 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13034
ReadX 13034 0 4096 4096
ReadX 13022 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13035
ReadX 13035 0 8192 8192
ReadX 13022 4096 16384 16384
Close 13029
Close 13022
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13036
FIND_FIRST \clients\client1\~dmtmp\*
Close 13036
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13037
ReadX 13037 0 4096 4096
ReadX 13037 4096 4096 4096
ReadX 13037 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13038
ReadX 13038 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13039
ReadX 13039 0 4096 4096
ReadX 13038 0 4096 4096
ReadX 13038 0 4096 4096
ReadX 13038 4096 16384 16384
Close 13039
WriteX 13038 0 4096 4096
Close 13038
WriteX 13023 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13040
FIND_FIRST \clients\client1\~dmtmp\*
Close 13040
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13041
ReadX 13041 0 4096 4096
ReadX 13041 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13042
ReadX 13042 0 4096 4096
ReadX 13042 0 4096 4096
WriteX 13042 0 4096 4096
Close 13042
WriteX 13017 0 4096 4096
WriteX 13018 0 4096 4096
WriteX 13019 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13043
ReadX 13043 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13044
ReadX 13044 0 4096 4096
ReadX 13043 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13048
FIND_FIRST \clients\client1\~dmtmp\*
Close 13048
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13049
QUERY_FILE_INFORMATION 13049
WriteX 13049 2047 1 1
QUERY_FILE_INFORMATION 13049
WriteX 13049 0 2048 2048
Close 13049
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13050
ReadX 13050 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13050 4095 1 1
QUERY_FILE_INFORMATION 13050
ReadX 13050 0 4096 4096
WriteX 13050 0 4096 4096
Close 13050
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13051
ReadX 13051 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13051 0 4096 4096
Close 13044
Close 13043
WriteX 13051 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13052
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13052 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13053
ReadX 13053 0 4096 4096
ReadX 13052 0 4096 4096
ReadX 13052 4096 16384 16384
Close 13053
Close 13052
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13054
FIND_FIRST \clients\client1\~dmtmp\*
Close 13054
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13055
ReadX 13055 0 4096 4096
ReadX 13055 4096 4096 4096
WriteX 13055 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13055 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13055
ReadX 13051 0 4096 4096
WriteX 13051 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13056
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13056 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13057
ReadX 13057 0 4096 4096
ReadX 13056 0 4096 4096
ReadX 13056 4096 16384 16384
Close 13057
Close 13056
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13058
FIND_FIRST \clients\client1\~dmtmp\*
Close 13058
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13059
ReadX 13059 0 4096 4096
ReadX 13059 4096 4096 4096
WriteX 13059 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13059 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13059
Close 13051
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13060
QUERY_FILE_INFORMATION 13060
Close 13060
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13035
Close 13037
Close 13041
Close 13020
Close 13017
Close 13018
Close 13019
Close 13028
Close 13033
Close 13030
Close 13031
Close 13032
Close 13034
Close 13023
Close 13026
Close 13027
Close 13024
Close 13025
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13061
FIND_FIRST \clients\client1\~dmtmp\*
Close 13061
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13062
ReadX 13062 0 4096 4096
ReadX 13062 4096 4096 4096
ReadX 13062 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13063
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13063 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13064
ReadX 13064 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13065
ReadX 13065 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13066
ReadX 13066 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13067
ReadX 13067 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13068
ReadX 13068 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13069
ReadX 13069 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13070
ReadX 13070 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13071
ReadX 13071 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13072
ReadX 13072 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13073
ReadX 13073 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13074
ReadX 13074 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13075
ReadX 13075 0 4096 4096
ReadX 13063 0 4096 4096
ReadX 13063 0 4096 4096
ReadX 13063 4096 16384 16384
Close 13070
Close 13063
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13076
ReadX 13076 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13077
ReadX 13077 0 4096 4096
ReadX 13076 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13081
FIND_FIRST \clients\client1\~dmtmp\*
Close 13081
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13082
QUERY_FILE_INFORMATION 13082
WriteX 13082 2047 1 1
QUERY_FILE_INFORMATION 13082
WriteX 13082 0 2048 2048
Close 13082
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13083
ReadX 13083 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13083 4095 1 1
QUERY_FILE_INFORMATION 13083
ReadX 13083 0 4096 4096
WriteX 13083 0 4096 4096
Close 13083
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13084
ReadX 13084 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13084 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13088
Close 13088
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13089
QUERY_FILE_INFORMATION 13089
WriteX 13089 2047 1 1
QUERY_FILE_INFORMATION 13089
WriteX 13089 0 2048 2048
Close 13089
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13090
ReadX 13090 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13090 4095 1 1
QUERY_FILE_INFORMATION 13090
ReadX 13090 0 4096 4096
WriteX 13090 0 4096 4096
Close 13090
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13091
ReadX 13091 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13091 0 4096 4096
Close 13076
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13092
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13092 0 4096 4096
ReadX 13092 0 4096 4096
ReadX 13092 4096 16384 16384
Close 13092
Close 13084
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13093
QUERY_FILE_INFORMATION 13093
Close 13093
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13062
Close 13074
Close 13069
Close 13075
Close 13077
Close 13064
Close 13067
Close 13068
Close 13065
Close 13066
Close 13071
Close 13072
Close 13073
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13091
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13094
QUERY_FILE_INFORMATION 13094
Close 13094
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13095
ReadX 13095 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13096
Close 13096
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13097
WriteX 13097 63 1 1
QUERY_FILE_INFORMATION 13097
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13095 0 4096 4096
ReadX 13095 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13095 0 8192 8192
Flush 13095
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13095 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13095 0 8192 8192
Flush 13095
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13095 0 8192 8192
Flush 13095
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13095 0 8192 8192
Flush 13095
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13099
Close 13099
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13101
WriteX 13101 4065 1 1
QUERY_FILE_INFORMATION 13101
WriteX 13101 0 62591 62591
Close 13101
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13103
Close 13103
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13105
WriteX 13105 4094 1 1
QUERY_FILE_INFORMATION 13105
WriteX 13105 0 10845 10845
Close 13105
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13107
Close 13107
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13109
WriteX 13109 4081 1 1
QUERY_FILE_INFORMATION 13109
WriteX 13109 0 30118 30118
Close 13109
WriteX 13095 0 4096 4096
Close 13095
WriteX 13097 0 64 64
Close 13097
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13110
ReadX 13110 61440 4096 4096
ReadX 13110 126976 4096 4096
WriteX 13110 0 65471 65471
WriteX 13110 65471 65 65
WriteX 13110 65536 65471 65471
WriteX 13110 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13111
ReadX 13111 61440 4096 4096
ReadX 13111 126976 4096 4096
ReadX 13111 192512 4096 4096
ReadX 13111 258048 4096 4096
WriteX 13111 0 65471 65471
WriteX 13111 65471 65 65
WriteX 13111 65536 65471 65471
WriteX 13111 131007 65 65
WriteX 13111 131072 65471 65471
WriteX 13111 196543 65 65
WriteX 13111 196608 65471 65471
WriteX 13111 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13112
ReadX 13112 61440 4096 4096
ReadX 13112 126976 4096 4096
ReadX 13112 192512 4096 4096
ReadX 13112 258048 4096 4096
ReadX 13112 323584 4096 4096
ReadX 13112 389120 4096 4096
ReadX 13112 454656 4096 4096
ReadX 13112 520192 4096 4096
WriteX 13112 0 65471 65471
WriteX 13112 65471 65 65
WriteX 13112 65536 65471 65471
WriteX 13112 131007 65 65
WriteX 13112 131072 65471 65471
WriteX 13112 196543 65 65
WriteX 13112 196608 65471 65471
WriteX 13112 262079 65 65
WriteX 13112 262144 65471 65471
WriteX 13112 327615 65 65
WriteX 13112 327680 65471 65471
WriteX 13112 393151 65 65
WriteX 13112 393216 65471 65471
WriteX 13112 458687 65 65
WriteX 13112 458752 65471 65471
WriteX 13112 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13113
Close 13113
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13110
Close 13111
Close 13112
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13114
ReadX 13114 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13115
ReadX 13115 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13116
ReadX 13116 0 4096 4096
ReadX 13116 4096 4096 4096
ReadX 13116 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13117
Close 13117
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13114
Close 13115
Close 13116
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13118
Close 13118
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13119
ReadX 13119 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13120
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13120
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13121
Close 13121
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13122
ReadX 13122 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13123
Close 13123
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13119
Close 13122
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13124
Close 13124
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13125
ReadX 13125 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13126
ReadX 13126 0 8192 8192
ReadX 13126 8192 8192 8192
ReadX 13126 16384 8192 8192
ReadX 13126 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13128
Close 13128
Close 13125
Close 13126
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13130
WriteX 13130 8191 1 1
QUERY_FILE_INFORMATION 13130
WriteX 13130 0 10438 10438
Close 13130
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13131
Close 13131
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13132
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13133
Close 13133
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13134
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13135
Close 13135
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13136
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13137
FIND_FIRST \clients\client1\~dmtmp\*
Close 13137
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13138
Close 13138
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13139
ReadX 13139 0 4096 4096
Close 13139
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13140
ReadX 13140 0 8192 8192
Close 13140
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13141
ReadX 13141 0 8192 8192
ReadX 13141 8192 4096 4096
ReadX 13141 12288 8192 8192
ReadX 13141 20480 8192 8192
ReadX 13141 28672 8192 8192
ReadX 13141 36864 8192 8192
ReadX 13141 45056 8192 8192
ReadX 13141 53248 8192 8192
ReadX 13141 61440 8192 8192
ReadX 13141 69632 8192 8192
ReadX 13141 77824 8192 8192
ReadX 13141 86016 8192 8192
ReadX 13141 94208 8192 8192
ReadX 13141 102400 8192 8192
ReadX 13141 110592 8192 8192
ReadX 13141 118784 8192 8192
ReadX 13141 126976 8192 8192
ReadX 13141 135168 8192 8192
ReadX 13141 143360 8192 8192
ReadX 13141 151552 8192 8192
ReadX 13141 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13142
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13142
Close 13141
Close 13132
Close 13134
Close 13136
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13143
Close 13143
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13145
WriteX 13145 8191 1 1
QUERY_FILE_INFORMATION 13145
WriteX 13145 0 28489 28489
Close 13145
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13146
Close 13146
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13147
FIND_FIRST \clients\client1\~dmtmp\*
Close 13147
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13148
Close 13148
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13149
ReadX 13149 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13150
Close 13150
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13149
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13151
Close 13151
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13152
ReadX 13152 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13153
ReadX 13153 0 8192 8192
ReadX 13153 8192 8192 8192
ReadX 13153 16384 8192 8192
ReadX 13153 24576 8192 8192
ReadX 13153 32768 16384 16384
ReadX 13153 49152 8192 8192
ReadX 13153 57344 8192 8192
ReadX 13153 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13155
Close 13155
Close 13152
Close 13153
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13157
WriteX 13157 8191 1 1
QUERY_FILE_INFORMATION 13157
WriteX 13157 0 29253 29253
Close 13157
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13158
Close 13158
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13159
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13160
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13160
Close 13159
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13161
Close 13161
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13163
WriteX 13163 8191 1 1
QUERY_FILE_INFORMATION 13163
WriteX 13163 0 30183 30183
Close 13163
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13164
Close 13164
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13165
WriteX 13165 0 510 510
WriteX 13165 510 512 512
WriteX 13165 1022 510 510
WriteX 13165 1532 510 510
WriteX 13165 2042 168 168
Close 13165
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13166
Close 13166
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13167
ReadX 13167 0 4096 4096
WriteX 13167 0 4096 4096
Close 13167
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13168
ReadX 13168 0 65471 65471
ReadX 13168 65471 65 65
ReadX 13168 65536 65471 65471
ReadX 13168 131007 65 65
ReadX 13168 131072 65471 65471
ReadX 13168 196543 65 65
ReadX 13168 196608 65471 65471
ReadX 13168 262079 65 65
ReadX 13168 262144 65471 65471
ReadX 13168 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13169
ReadX 13169 0 65471 65471
ReadX 13169 65471 65 65
ReadX 13169 65536 65471 65471
ReadX 13169 131007 65 65
ReadX 13169 131072 65471 65471
ReadX 13169 196543 65 65
ReadX 13169 196608 65471 65471
ReadX 13169 262079 65 65
ReadX 13169 262144 65471 65471
ReadX 13169 327615 65 65
ReadX 13169 327680 65471 65471
ReadX 13169 393151 65 65
ReadX 13169 393216 65471 65471
ReadX 13169 458687 65 65
ReadX 13169 458752 65471 65471
ReadX 13169 524223 65 65
ReadX 13169 524288 65471 65471
ReadX 13169 589759 65 65
ReadX 13169 589824 65471 65471
ReadX 13169 655295 65 65
ReadX 13169 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13170
ReadX 13170 0 65471 65471
ReadX 13170 65471 65 65
ReadX 13170 65536 65471 65471
ReadX 13170 131007 65 65
ReadX 13170 131072 65471 65471
ReadX 13170 196543 65 65
ReadX 13170 196608 65471 65471
ReadX 13170 262079 65 65
ReadX 13170 262144 65471 65471
ReadX 13170 327615 65 65
ReadX 13170 327680 65471 65471
ReadX 13170 393151 65 65
ReadX 13170 393216 65471 65471
ReadX 13170 458687 65 65
ReadX 13170 458752 65471 65471
ReadX 13170 524223 65 65
ReadX 13170 524288 65471 65471
ReadX 13170 589759 65 65
ReadX 13170 589824 65471 65471
ReadX 13170 655295 65 65
ReadX 13170 655360 65471 65471
ReadX 13170 720831 65 65
ReadX 13170 720896 65471 65471
ReadX 13170 786367 65 65
ReadX 13170 786432 65471 65471
ReadX 13170 851903 65 65
ReadX 13170 851968 65471 65471
ReadX 13170 917439 65 65
ReadX 13170 917504 65471 65471
ReadX 13170 982975 65 65
ReadX 13170 983040 65471 65471
ReadX 13170 1048511 65 65
ReadX 13170 1048576 65471 65471
ReadX 13170 1114047 65 65
ReadX 13170 1114112 65471 65471
ReadX 13170 1179583 65 65
ReadX 13170 1179648 65471 65471
ReadX 13170 1245119 65 65
ReadX 13170 1245184 65471 65471
ReadX 13170 1310655 65 65
ReadX 13170 1310720 65471 65471
ReadX 13170 1376191 65 65
ReadX 13170 1376256 65471 65471
ReadX 13170 1441727 65 65
ReadX 13170 1441792 65471 65471
ReadX 13170 1507263 65 65
ReadX 13170 1507328 65471 65471
ReadX 13170 1572799 65 65
ReadX 13170 1572864 65471 65471
ReadX 13170 1638335 65 65
ReadX 13170 1638400 65471 65471
ReadX 13170 1703871 65 65
ReadX 13170 1703936 65471 65471
ReadX 13170 1769407 65 65
ReadX 13170 1769472 65471 65471
ReadX 13170 1834943 65 65
ReadX 13170 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13171
ReadX 13171 0 4096 4096
ReadX 13171 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13172
WriteX 13172 52 1 1
QUERY_FILE_INFORMATION 13172
WriteX 13172 0 53 53
Close 13172
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13173
Close 13173
Close 13168
Close 13169
Close 13170
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13171 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13174
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13171 0 4096 4096
ReadX 13171 4096 4096 4096
ReadX 13171 8192 4096 4096
ReadX 13171 12288 4096 4096
WriteX 13174 15359 1 1
QUERY_FILE_INFORMATION 13174
ReadX 13171 16384 4096 4096
ReadX 13171 20480 4096 4096
WriteX 13174 0 15360 15360
Close 13174
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13175
ReadX 13175 0 4096 4096
WriteX 13175 0 4096 4096
Close 13175
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13176
Close 13176
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13177
ReadX 13177 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13178
Close 13178
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13171
ReadX 13177 0 4096 4096
ReadX 13177 4096 4096 4096
ReadX 13177 8192 4096 4096
ReadX 13177 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13179
ReadX 13179 0 4096 4096
ReadX 13179 0 4096 4096
ReadX 13179 4096 4096 4096
ReadX 13179 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13180
ReadX 13180 0 4096 4096
ReadX 13180 4096 4096 4096
ReadX 13180 8192 4096 4096
Close 13179
Close 13180
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13181
WriteX 13181 15359 1 1
QUERY_FILE_INFORMATION 13181
WriteX 13181 0 15360 15360
Close 13181
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13182
ReadX 13182 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13177
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13183
Close 13183
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13184
ReadX 13184 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13185
Close 13185
WriteX 13182 0 4096 4096
Close 13182
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13186
Close 13186
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13187
ReadX 13187 0 4096 4096
ReadX 13187 0 4096 4096
ReadX 13187 4096 4096 4096
ReadX 13187 8192 4096 4096
ReadX 13187 12288 3072 3072
ReadX 13187 0 8192 8192
ReadX 13187 8192 4096 4096
ReadX 13187 12288 3072 3072
WriteX 13187 15469 1 1
QUERY_FILE_INFORMATION 13187
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13188
ReadX 13188 0 4096 4096
ReadX 13188 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13189
WriteX 13189 52 1 1
QUERY_FILE_INFORMATION 13189
WriteX 13189 0 53 53
Close 13189
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13190
Close 13190
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13191
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13188 0 8192 8192
ReadX 13188 8192 4096 4096
ReadX 13188 12288 4096 4096
WriteX 13191 12005 1 1
QUERY_FILE_INFORMATION 13191
WriteX 13191 0 12006 12006
Close 13191
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13192
ReadX 13192 0 4096 4096
WriteX 13192 0 4096 4096
Close 13192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13193
Close 13193
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13194
ReadX 13194 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13195
Close 13195
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13188
ReadX 13194 0 4096 4096
ReadX 13194 4096 4096 4096
ReadX 13194 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13196
WriteX 13196 11990 1 1
QUERY_FILE_INFORMATION 13196
WriteX 13196 0 11991 11991
Close 13196
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13197
ReadX 13197 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13194
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13198
Close 13198
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13199
ReadX 13199 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13200
Close 13200
WriteX 13197 0 4096 4096
Close 13197
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13201
Close 13201
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13202
ReadX 13202 0 4096 4096
ReadX 13202 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13203
Close 13203
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13202 0 8192 8192
ReadX 13202 8192 3799 3799
WriteX 13202 13247 1 1
QUERY_FILE_INFORMATION 13202
WriteX 13202 0 14984 14984
WriteX 13187 0 19054 19054
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13202 0 8192 8192
ReadX 13202 8192 4096 4096
Close 13184
Close 13187
WriteX 13202 0 12288 12288
Close 13202
Close 13199
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13204
Close 13204
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13205
Close 13205
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13206
ReadX 13206 61440 4096 4096
ReadX 13206 126976 4096 4096
WriteX 13206 0 65471 65471
WriteX 13206 65471 65 65
WriteX 13206 65536 65471 65471
WriteX 13206 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13207
ReadX 13207 61440 4096 4096
ReadX 13207 126976 4096 4096
ReadX 13207 192512 4096 4096
ReadX 13207 258048 4096 4096
WriteX 13207 0 65471 65471
WriteX 13207 65471 65 65
WriteX 13207 65536 65471 65471
WriteX 13207 131007 65 65
WriteX 13207 131072 65471 65471
WriteX 13207 196543 65 65
WriteX 13207 196608 65471 65471
WriteX 13207 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13208
ReadX 13208 61440 4096 4096
ReadX 13208 126976 4096 4096
ReadX 13208 192512 4096 4096
ReadX 13208 258048 4096 4096
ReadX 13208 323584 4096 4096
ReadX 13208 389120 4096 4096
ReadX 13208 454656 4096 4096
ReadX 13208 520192 4096 4096
WriteX 13208 0 65471 65471
WriteX 13208 65471 65 65
WriteX 13208 65536 65471 65471
WriteX 13208 131007 65 65
WriteX 13208 131072 65471 65471
WriteX 13208 196543 65 65
WriteX 13208 196608 65471 65471
WriteX 13208 262079 65 65
WriteX 13208 262144 65471 65471
WriteX 13208 327615 65 65
WriteX 13208 327680 65471 65471
WriteX 13208 393151 65 65
WriteX 13208 393216 65471 65471
WriteX 13208 458687 65 65
WriteX 13208 458752 65471 65471
WriteX 13208 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13209
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13209 0 4096 4096
Close 13209
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13210
ReadX 13210 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13210
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13211
ReadX 13211 0 4096 4096
ReadX 13211 4096 4096 4096
ReadX 13211 8192 4096 4096
ReadX 13211 12288 4096 4096
ReadX 13211 16384 4096 4096
ReadX 13211 20480 4096 4096
ReadX 13211 24576 4096 4096
ReadX 13211 28672 4096 4096
ReadX 13211 32768 4096 4096
ReadX 13211 36864 4096 4096
ReadX 13211 40960 4096 4096
ReadX 13211 45056 4096 4096
ReadX 13211 49152 4096 4096
ReadX 13211 53248 4096 4096
ReadX 13211 57344 4096 4096
ReadX 13211 61440 4096 4096
ReadX 13211 65536 4096 4096
ReadX 13211 69632 4096 4096
ReadX 13211 73728 4096 4096
WriteX 13211 0 4096 4096
Close 13211
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13212
Close 13212
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13213
ReadX 13213 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13214
Close 13214
Close 13206
Close 13207
Close 13208
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13213
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13216
WriteX 13216 4607 1 1
QUERY_FILE_INFORMATION 13216
WriteX 13216 0 65471 65471
WriteX 13216 65471 65 65
WriteX 13216 65536 19979 19979
Close 13216
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13217
ReadX 13217 0 4096 4096
WriteX 13217 0 4096 4096
Flush 13217
WriteX 13217 0 4096 4096
Flush 13217
QUERY_FILE_INFORMATION 13217
WriteX 13217 0 4096 4096
Flush 13217
WriteX 13217 0 4096 4096
Flush 13217
WriteX 13217 0 4096 4096
Flush 13217
WriteX 13217 0 4096 4096
Flush 13217
Close 13217
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13218
ReadX 13218 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13219
ReadX 13219 0 4096 4096
Close 13218
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13220
ReadX 13220 0 4096 4096
Close 13220
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13221
ReadX 13221 0 4096 4096
Close 13221
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13222
ReadX 13222 0 4096 4096
WriteX 13222 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13223
Close 13223
Close 13219
Close 13222
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13224
Close 13224
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13226
WriteX 13226 4607 1 1
QUERY_FILE_INFORMATION 13226
WriteX 13226 0 65471 65471
WriteX 13226 65471 65 65
WriteX 13226 65536 17654 17654
Close 13226
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13227
ReadX 13227 0 4096 4096
WriteX 13227 0 4096 4096
Flush 13227
WriteX 13227 0 4096 4096
Flush 13227
QUERY_FILE_INFORMATION 13227
WriteX 13227 0 4096 4096
Flush 13227
WriteX 13227 0 4096 4096
Flush 13227
WriteX 13227 0 4096 4096
Flush 13227
WriteX 13227 0 4096 4096
Flush 13227
Close 13227
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13228
Close 13228
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13229
ReadX 13229 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13230
Close 13230
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13231
ReadX 13231 0 4096 4096
ReadX 13231 4096 4096 4096
ReadX 13231 8192 4096 4096
ReadX 13231 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13231 16384 4096 4096
ReadX 13231 20480 4096 4096
ReadX 13231 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13229
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13232
ReadX 13232 0 4096 4096
Close 13232
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13233
ReadX 13233 0 4096 4096
Close 13233
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13234
ReadX 13234 0 4096 4096
WriteX 13234 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13235
Close 13235
Close 13234
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13236
Close 13236
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13238
WriteX 13238 4607 1 1
QUERY_FILE_INFORMATION 13238
WriteX 13238 0 65471 65471
WriteX 13238 65471 65 65
WriteX 13238 65536 19490 19490
Close 13238
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13239
ReadX 13239 0 4096 4096
WriteX 13239 0 4096 4096
Flush 13239
WriteX 13239 0 4096 4096
Flush 13239
QUERY_FILE_INFORMATION 13239
WriteX 13239 0 4096 4096
Flush 13239
WriteX 13239 0 4096 4096
Flush 13239
WriteX 13239 0 4096 4096
Flush 13239
WriteX 13239 0 4096 4096
Flush 13239
Close 13239
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13240
Close 13240
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13241
ReadX 13241 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13242
Close 13242
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13241
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13243
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13243 0 4096 4096
Close 13243
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13244
ReadX 13244 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13244
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13245
ReadX 13245 0 4096 4096
ReadX 13245 4096 4096 4096
ReadX 13245 8192 4096 4096
ReadX 13245 12288 4096 4096
ReadX 13245 16384 4096 4096
ReadX 13245 20480 4096 4096
ReadX 13245 24576 4096 4096
ReadX 13245 28672 4096 4096
ReadX 13245 32768 4096 4096
ReadX 13245 36864 4096 4096
ReadX 13245 40960 4096 4096
ReadX 13245 45056 4096 4096
ReadX 13245 49152 4096 4096
ReadX 13245 53248 4096 4096
ReadX 13245 57344 4096 4096
ReadX 13245 61440 4096 4096
ReadX 13245 65536 4096 4096
ReadX 13245 69632 4096 4096
ReadX 13245 73728 4096 4096
WriteX 13245 0 4096 4096
Close 13245
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13246
Close 13246
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13247
ReadX 13247 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13248
Close 13248
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13247
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13250
WriteX 13250 4607 1 1
QUERY_FILE_INFORMATION 13250
WriteX 13250 0 65471 65471
WriteX 13250 65471 65 65
WriteX 13250 65536 8866 8866
Close 13250
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13251
ReadX 13251 0 4096 4096
WriteX 13251 0 4096 4096
Flush 13251
WriteX 13251 0 4096 4096
Flush 13251
Close 13251
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13252
ReadX 13252 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13252
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13253
ReadX 13253 0 4096 4096
Close 13253
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13254
ReadX 13254 0 4096 4096
Close 13254
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13255
ReadX 13255 0 4096 4096
WriteX 13255 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13256
Close 13256
Close 13255
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13257
Close 13257
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13259
WriteX 13259 4607 1 1
QUERY_FILE_INFORMATION 13259
WriteX 13259 0 65471 65471
WriteX 13259 65471 65 65
WriteX 13259 65536 9298 9298
Close 13259
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13260
ReadX 13260 0 4096 4096
WriteX 13260 0 4096 4096
Flush 13260
WriteX 13260 0 4096 4096
Flush 13260
Close 13260
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13261
Close 13261
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13262
ReadX 13262 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13263
Close 13263
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13265
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13265 0 4096 4096
Close 13265
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13266
ReadX 13266 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13266 4096 4096 4096
ReadX 13266 8192 4096 4096
ReadX 13266 12288 4096 4096
ReadX 13266 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13262
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13267
ReadX 13267 0 4096 4096
Close 13267
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13268
ReadX 13268 0 4096 4096
Close 13268
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13269
ReadX 13269 0 4096 4096
WriteX 13269 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13270
Close 13270
Close 13266
Close 13269
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13271
Close 13271
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13273
WriteX 13273 4607 1 1
QUERY_FILE_INFORMATION 13273
WriteX 13273 0 65471 65471
WriteX 13273 65471 65 65
WriteX 13273 65536 11540 11540
Close 13273
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13274
ReadX 13274 0 4096 4096
WriteX 13274 0 4096 4096
Flush 13274
WriteX 13274 0 4096 4096
Flush 13274
Close 13274
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13275
Close 13275
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13276
ReadX 13276 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13277
Close 13277
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13276
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13278
ReadX 13278 0 65471 65471
ReadX 13278 65471 65 65
ReadX 13278 65536 65471 65471
ReadX 13278 131007 65 65
ReadX 13278 131072 65471 65471
ReadX 13278 196543 65 65
ReadX 13278 196608 65471 65471
ReadX 13278 262079 65 65
ReadX 13278 262144 65471 65471
ReadX 13278 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13279
ReadX 13279 0 65471 65471
ReadX 13279 65471 65 65
ReadX 13279 65536 65471 65471
ReadX 13279 131007 65 65
ReadX 13279 131072 65471 65471
ReadX 13279 196543 65 65
ReadX 13279 196608 65471 65471
ReadX 13279 262079 65 65
ReadX 13279 262144 65471 65471
ReadX 13279 327615 65 65
ReadX 13279 327680 65471 65471
ReadX 13279 393151 65 65
ReadX 13279 393216 65471 65471
ReadX 13279 458687 65 65
ReadX 13279 458752 65471 65471
ReadX 13279 524223 65 65
ReadX 13279 524288 65471 65471
ReadX 13279 589759 65 65
ReadX 13279 589824 65471 65471
ReadX 13279 655295 65 65
ReadX 13279 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13280
ReadX 13280 0 65471 65471
ReadX 13280 65471 65 65
ReadX 13280 65536 65471 65471
ReadX 13280 131007 65 65
ReadX 13280 131072 65471 65471
ReadX 13280 196543 65 65
ReadX 13280 196608 65471 65471
ReadX 13280 262079 65 65
ReadX 13280 262144 65471 65471
ReadX 13280 327615 65 65
ReadX 13280 327680 65471 65471
ReadX 13280 393151 65 65
ReadX 13280 393216 65471 65471
ReadX 13280 458687 65 65
ReadX 13280 458752 65471 65471
ReadX 13280 524223 65 65
ReadX 13280 524288 65471 65471
ReadX 13280 589759 65 65
ReadX 13280 589824 65471 65471
ReadX 13280 655295 65 65
ReadX 13280 655360 65471 65471
ReadX 13280 720831 65 65
ReadX 13280 720896 65471 65471
ReadX 13280 786367 65 65
ReadX 13280 786432 65471 65471
ReadX 13280 851903 65 65
ReadX 13280 851968 65471 65471
ReadX 13280 917439 65 65
ReadX 13280 917504 65471 65471
ReadX 13280 982975 65 65
ReadX 13280 983040 65471 65471
ReadX 13280 1048511 65 65
ReadX 13280 1048576 65471 65471
ReadX 13280 1114047 65 65
ReadX 13280 1114112 65471 65471
ReadX 13280 1179583 65 65
ReadX 13280 1179648 65471 65471
ReadX 13280 1245119 65 65
ReadX 13280 1245184 65471 65471
Close 13231
ReadX 13280 1310655 65 65
ReadX 13280 1310720 65471 65471
Close 13278
ReadX 13280 1376191 65 65
ReadX 13280 1376256 65471 65471
Close 13279
ReadX 13280 1441727 65 65
ReadX 13280 1441792 65471 65471
ReadX 13280 1507263 65 65
ReadX 13280 1507328 65471 65471
ReadX 13280 1572799 65 65
ReadX 13280 1572864 65471 65471
ReadX 13280 1638335 65 65
ReadX 13280 1638400 65471 65471
ReadX 13280 1703871 65 65
ReadX 13280 1703936 65471 65471
ReadX 13280 1769407 65 65
ReadX 13280 1769472 65471 65471
ReadX 13280 1834943 65 65
ReadX 13280 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13281
FIND_FIRST \clients\client1\~dmtmp\*
Close 13281
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13282
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13283
QUERY_FILE_INFORMATION 13283
QUERY_FILE_INFORMATION 13283
QUERY_FILE_INFORMATION 13283
ReadX 13283 2156 24 24
ReadX 13283 2139 276 276
ReadX 13283 2136 14 14
ReadX 13283 2136 7 7
ReadX 13283 2138 12 12
ReadX 13283 2137 8 8
ReadX 13283 2135 15 15
ReadX 13283 0 16 16
ReadX 13283 16 2048 2048
ReadX 13283 2064 2048 2048
ReadX 13283 257 2048 2048
ReadX 13283 385 2048 2048
ReadX 13283 513 2048 2048
ReadX 13283 641 2048 2048
ReadX 13283 769 2048 2048
ReadX 13283 897 2048 2048
ReadX 13283 1025 2048 2048
ReadX 13283 1153 2048 2048
ReadX 13283 1281 2048 2048
ReadX 13283 1409 2048 2048
ReadX 13283 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13285
Close 13285
Close 13280
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13287
WriteX 13287 15 1 1
QUERY_FILE_INFORMATION 13287
WriteX 13287 0 10575 10575
Flush 13287
Close 13287
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13288
Close 13288
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13289
ReadX 13289 0 4096 4096
Close 13283
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13290
Close 13290
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13291
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13292
QUERY_FILE_INFORMATION 13292
ReadX 13292 0 512 512
ReadX 13292 512 512 512
ReadX 13292 1024 512 512
QUERY_FILE_INFORMATION 13292
QUERY_FILE_INFORMATION 13292
Close 13292
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13293
QUERY_FILE_INFORMATION 13293
ReadX 13293 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13294
QUERY_FILE_INFORMATION 13294
ReadX 13294 0 512 512
ReadX 13294 512 512 512
ReadX 13294 1024 512 512
ReadX 13294 288 20 20
ReadX 13294 308 2084 2084
ReadX 13294 388 2084 2084
ReadX 13294 388 2084 2084
ReadX 13282 2157 1386 1386
ReadX 13294 2472 399 399
ReadX 13294 3072 1536 1536
ReadX 13294 544 149 149
ReadX 13294 693 485 485
Close 13294
ReadX 13282 2157 4096 4096
ReadX 13282 6253 4096 4096
ReadX 13282 10349 4096 4096
ReadX 13282 14445 4096 4096
ReadX 13282 18541 4096 4096
ReadX 13282 22637 256 256
ReadX 13282 22893 4096 4096
ReadX 13282 26989 4096 4096
ReadX 13282 31085 4096 4096
ReadX 13282 35181 4096 4096
ReadX 13282 39277 4096 4096
ReadX 13282 43373 4096 4096
ReadX 13282 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13282 2157 1024 1024
ReadX 13282 1667 4688 4688
ReadX 13282 6355 3516 3516
ReadX 13282 9871 16384 16384
ReadX 13282 26255 3771 3771
ReadX 13282 30026 2048 2048
ReadX 13282 32074 1024 1024
ReadX 13282 33098 6652 6652
ReadX 13282 39750 16384 16384
ReadX 13282 56134 10496 10496
ReadX 13282 66630 1784 1784
ReadX 13282 68414 90 90
ReadX 13282 68504 273 273
ReadX 13282 68777 1600 1600
ReadX 13282 70377 640 640
ReadX 13282 71017 1280 1280
ReadX 13282 72297 8464 8464
ReadX 13282 80761 158 158
ReadX 13282 80919 912 912
ReadX 13282 81831 1980 1980
ReadX 13282 83811 2256 2256
ReadX 13282 86067 400 400
ReadX 13282 86467 252 252
ReadX 13282 86719 42 42
ReadX 13282 86761 725 725
ReadX 13282 2009 512 512
ReadX 13282 3895 9 9
ReadX 13282 3781 46 46
ReadX 13282 4059 92 92
ReadX 13282 3781 92 92
ReadX 13282 3986 184 184
ReadX 13282 3987 16384 16384
ReadX 13282 3902 16384 16384
ReadX 13282 3781 10240 10240
ReadX 13282 3821 16384 16384
ReadX 13282 3891 935 935
ReadX 13282 4060 10240 10240
ReadX 13282 4059 184 184
ReadX 13282 256 184 184
ReadX 13282 256 1026 1026
ReadX 13282 3901 326 326
ReadX 13282 3899 652 652
ReadX 13282 256 2 2
ReadX 13282 258 4948 4948
Close 13282
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13296
Close 13296
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13298
WriteX 13298 4055 1 1
QUERY_FILE_INFORMATION 13298
WriteX 13298 0 65471 65471
WriteX 13298 65471 65 65
WriteX 13298 65536 65471 65471
WriteX 13298 131007 65 65
WriteX 13298 131072 65471 65471
WriteX 13298 196543 65 65
WriteX 13298 196608 65471 65471
WriteX 13298 262079 65 65
WriteX 13298 262144 65471 65471
WriteX 13298 327615 65 65
WriteX 13298 327680 65471 65471
WriteX 13298 393151 65 65
WriteX 13298 393216 65471 65471
WriteX 13298 458687 65 65
WriteX 13298 458752 65471 65471
WriteX 13298 524223 65 65
WriteX 13298 524288 65471 65471
WriteX 13298 589759 65 65
WriteX 13298 589824 35257 35257
Close 13298
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13300
Close 13300
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13302
WriteX 13302 4055 1 1
QUERY_FILE_INFORMATION 13302
WriteX 13302 0 65471 65471
WriteX 13302 65471 65 65
WriteX 13302 65536 65471 65471
WriteX 13302 131007 65 65
WriteX 13302 131072 65471 65471
WriteX 13302 196543 65 65
WriteX 13302 196608 65471 65471
WriteX 13302 262079 65 65
WriteX 13302 262144 65471 65471
WriteX 13302 327615 65 65
WriteX 13302 327680 65471 65471
WriteX 13302 393151 65 65
WriteX 13302 393216 65471 65471
WriteX 13302 458687 65 65
WriteX 13302 458752 65471 65471
WriteX 13302 524223 65 65
WriteX 13302 524288 65471 65471
WriteX 13302 589759 65 65
WriteX 13302 589824 57598 57598
Close 13302
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13304
WriteX 13304 15 1 1
QUERY_FILE_INFORMATION 13304
WriteX 13304 0 12543 12543
Flush 13304
Close 13304
Close 13289
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13305
Close 13305
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13306
ReadX 13306 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13307
FIND_FIRST \clients\client1\~dmtmp\*
Close 13307
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13308
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13309
QUERY_FILE_INFORMATION 13309
QUERY_FILE_INFORMATION 13309
QUERY_FILE_INFORMATION 13309
ReadX 13309 1938 24 24
ReadX 13309 1920 276 276
ReadX 13309 1918 14 14
ReadX 13309 1918 7 7
ReadX 13309 1919 12 12
ReadX 13309 1919 8 8
ReadX 13309 1917 15 15
ReadX 13309 0 16 16
ReadX 13309 16 2048 2048
ReadX 13309 2064 2048 2048
ReadX 13309 257 2048 2048
ReadX 13309 385 2048 2048
ReadX 13309 513 2048 2048
ReadX 13309 641 2048 2048
ReadX 13309 769 2048 2048
ReadX 13309 897 2048 2048
ReadX 13309 1025 2048 2048
ReadX 13309 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13311
Close 13311
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13313
WriteX 13313 15 1 1
QUERY_FILE_INFORMATION 13313
WriteX 13313 0 11588 11588
Flush 13313
Close 13313
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13314
Close 13314
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13315
ReadX 13315 0 4096 4096
Close 13309
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13317
WriteX 13317 15 1 1
QUERY_FILE_INFORMATION 13317
WriteX 13317 0 11615 11615
Flush 13317
Close 13317
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13315
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13318
Close 13318
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13319
ReadX 13319 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13321
Close 13321
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13323
WriteX 13323 4088 1 1
QUERY_FILE_INFORMATION 13323
WriteX 13323 0 65471 65471
WriteX 13323 65471 65 65
WriteX 13323 65536 16050 16050
Close 13323
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13308 1939 64 64
ReadX 13308 128 248 248
ReadX 13308 128 568 568
ReadX 13308 3872 1536 1536
ReadX 13308 3456 2560 2560
ReadX 13308 3136 512 512
ReadX 13308 2880 4096 4096
ReadX 13308 3264 3072 3072
ReadX 13308 320 4096 4096
ReadX 13308 1024 4096 4096
ReadX 13308 3616 4096 4096
ReadX 13308 1939 64 64
ReadX 13308 128 248 248
ReadX 13308 128 608 608
ReadX 13308 2858 1024 1024
ReadX 13308 2810 4096 4096
ReadX 13308 2826 4096 4096
ReadX 13308 2580 2048 2048
ReadX 13308 2800 2560 2560
ReadX 13308 2100 4096 4096
ReadX 13308 2084 4096 4096
ReadX 13308 868 4096 4096
ReadX 13308 2324 4096 4096
ReadX 13308 884 4096 4096
ReadX 13308 2604 1024 1024
ReadX 13308 580 4096 4096
ReadX 13308 596 4096 4096
ReadX 13308 2752 4096 4096
ReadX 13308 2842 1024 1024
ReadX 13308 660 4096 4096
ReadX 13308 2720 4096 4096
ReadX 13308 2736 4096 4096
ReadX 13308 628 4096 4096
ReadX 13308 2704 4096 4096
ReadX 13308 1556 4096 4096
ReadX 13308 576 4096 4096
ReadX 13308 3168 1536 1536
ReadX 13308 832 4096 4096
ReadX 13308 1088 4096 4096
ReadX 13308 1344 4096 4096
ReadX 13308 1600 4096 4096
ReadX 13308 1856 4096 4096
ReadX 13308 2112 4096 4096
ReadX 13308 1892 4096 4096
ReadX 13308 820 4096 4096
ReadX 13308 788 4096 4096
ReadX 13308 1604 4096 4096
ReadX 13308 3648 4096 4096
ReadX 13308 2608 4096 4096
ReadX 13308 548 4096 4096
ReadX 13308 740 4096 4096
ReadX 13308 1344 4096 4096
ReadX 13308 3392 4096 4096
ReadX 13308 3904 4096 4096
ReadX 13308 644 4096 4096
ReadX 13308 676 4096 4096
ReadX 13308 2688 4096 4096
ReadX 13308 320 4096 4096
ReadX 13308 900 4096 4096
ReadX 13308 1908 4096 4096
ReadX 13308 852 4096 4096
ReadX 13308 724 4096 4096
ReadX 13308 2292 4096 4096
ReadX 13308 612 4096 4096
ReadX 13308 388 4096 4096
ReadX 13308 2368 4096 4096
ReadX 13308 2624 4096 4096
ReadX 13308 500 4096 4096
ReadX 13308 356 4096 4096
ReadX 13308 1024 4096 4096
ReadX 13308 576 4096 4096
ReadX 13308 340 4096 4096
ReadX 13308 420 4096 4096
ReadX 13308 1600 4096 4096
ReadX 13308 404 4096 4096
ReadX 13308 1428 4096 4096
ReadX 13308 2656 4096 4096
ReadX 13308 2624 4096 4096
ReadX 13308 452 4096 4096
ReadX 13308 692 4096 4096
ReadX 13308 564 4096 4096
ReadX 13308 372 4096 4096
ReadX 13308 468 4096 4096
ReadX 13308 484 4096 4096
ReadX 13308 1088 4096 4096
ReadX 13308 1924 4096 4096
ReadX 13308 2768 4096 4096
ReadX 13308 832 4096 4096
ReadX 13308 836 4096 4096
ReadX 13308 1856 4096 4096
ReadX 13308 2640 4096 4096
ReadX 13308 436 4096 4096
ReadX 13308 1828 4096 4096
ReadX 13308 804 4096 4096
ReadX 13308 1860 4096 4096
ReadX 13308 1812 4096 4096
ReadX 13308 756 4096 4096
ReadX 13308 1636 4096 4096
ReadX 13308 772 4096 4096
ReadX 13308 2036 4096 4096
ReadX 13308 1220 4096 4096
ReadX 13308 1652 4096 4096
ReadX 13308 2588 4096 4096
ReadX 13308 916 4096 4096
ReadX 13308 260 4096 4096
ReadX 13308 932 4096 4096
ReadX 13308 2624 4096 4096
ReadX 13308 308 4096 4096
ReadX 13308 292 4096 4096
ReadX 13308 1140 4096 4096
ReadX 13308 276 4096 4096
ReadX 13308 2020 4096 4096
ReadX 13308 2880 4096 4096
ReadX 13308 516 4096 4096
ReadX 13308 1844 4096 4096
ReadX 13308 1124 4096 4096
ReadX 13308 3136 4096 4096
ReadX 13308 324 4096 4096
ReadX 13308 1156 4096 4096
ReadX 13308 1172 4096 4096
ReadX 13308 2112 4096 4096
ReadX 13308 2368 4096 4096
ReadX 13308 964 4096 4096
ReadX 13308 980 4096 4096
ReadX 13308 1012 4096 4096
ReadX 13308 532 4096 4096
ReadX 13308 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13308 1620 4096 4096
ReadX 13308 1604 4096 4096
ReadX 13308 2116 4096 4096
ReadX 13308 2132 4096 4096
ReadX 13308 2148 4096 4096
ReadX 13308 2276 4096 4096
ReadX 13308 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13325
Close 13325
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13327
QUERY_FILE_INFORMATION 13291
Close 13291
WriteX 13327 4088 1 1
QUERY_FILE_INFORMATION 13327
QUERY_FILE_INFORMATION 13293
Close 13293
WriteX 13327 0 65471 65471
WriteX 13327 65471 65 65
WriteX 13327 65536 64850 64850
Close 13327
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13329
WriteX 13329 15 1 1
QUERY_FILE_INFORMATION 13329
ReadX 13308 2068 4096 4096
ReadX 13308 1588 4096 4096
ReadX 13308 1572 4096 4096
WriteX 13329 0 18630 18630
Flush 13329
Close 13329
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13319
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13330
Close 13330
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13331
ReadX 13331 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13308 612 4096 4096
ReadX 13308 564 4096 4096
ReadX 13308 1876 4096 4096
ReadX 13308 628 4096 4096
ReadX 13308 740 4096 4096
ReadX 13308 724 4096 4096
ReadX 13308 644 4096 4096
ReadX 13308 2324 4096 4096
ReadX 13308 660 4096 4096
ReadX 13308 852 4096 4096
ReadX 13308 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13308 2368 4096 4096
ReadX 13308 1024 4096 4096
ReadX 13308 320 4096 4096
ReadX 13308 580 4096 4096
ReadX 13308 3136 512 512
ReadX 13308 2880 4096 4096
Close 13308
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13332
ReadX 13332 61440 4096 4096
ReadX 13332 126976 4096 4096
WriteX 13332 0 65471 65471
WriteX 13332 65471 65 65
WriteX 13332 65536 65471 65471
WriteX 13332 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13333
ReadX 13333 61440 4096 4096
ReadX 13333 126976 4096 4096
ReadX 13333 192512 4096 4096
ReadX 13333 258048 4096 4096
WriteX 13333 0 65471 65471
WriteX 13333 65471 65 65
WriteX 13333 65536 65471 65471
WriteX 13333 131007 65 65
WriteX 13333 131072 65471 65471
WriteX 13333 196543 65 65
WriteX 13333 196608 65471 65471
WriteX 13333 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13334
ReadX 13334 61440 4096 4096
ReadX 13334 126976 4096 4096
ReadX 13334 192512 4096 4096
ReadX 13334 258048 4096 4096
ReadX 13334 323584 4096 4096
ReadX 13334 389120 4096 4096
ReadX 13334 454656 4096 4096
ReadX 13334 520192 4096 4096
WriteX 13334 0 65471 65471
WriteX 13334 65471 65 65
WriteX 13334 65536 65471 65471
WriteX 13334 131007 65 65
WriteX 13334 131072 65471 65471
WriteX 13334 196543 65 65
WriteX 13334 196608 65471 65471
WriteX 13334 262079 65 65
WriteX 13334 262144 65471 65471
WriteX 13334 327615 65 65
WriteX 13334 327680 65471 65471
WriteX 13334 393151 65 65
WriteX 13334 393216 65471 65471
WriteX 13334 458687 65 65
WriteX 13334 458752 65471 65471
WriteX 13334 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13335
Close 13335
Close 13331
Close 13306
Close 13332
Close 13333
Close 13334
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13336
Close 13336
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13339
Close 13339
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13341
Close 13341
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13342
Close 13342
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13345
Close 13345
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13347
Close 13347
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13348
Close 13348
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13351
Close 13351
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13355
Close 13355
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13359
Close 13359
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13363
Close 13363
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13367
Close 13367
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13371
Close 13371
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13375
Close 13375
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13379
Close 13379
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13381
Close 13381
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13383
Close 13383
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13385
WriteX 13385 4095 1 1
QUERY_FILE_INFORMATION 13385
QUERY_FS_INFORMATION 259
WriteX 13385 0 65471 65471
WriteX 13385 65471 65 65
WriteX 13385 65536 65471 65471
WriteX 13385 131007 65 65
WriteX 13385 131072 65471 65471
WriteX 13385 196543 65 65
WriteX 13385 196608 65471 65471
WriteX 13385 262079 65 65
WriteX 13385 262144 26634 26634
Close 13385
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13390
Close 13390
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13391
Close 13391
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13392
ReadX 13392 0 4096 4096
Close 13392
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13393
ReadX 13393 0 4096 4096
ReadX 13393 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13394
Close 13394
Close 13393
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13397
Close 13397
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13399
Close 13399
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13400
Close 13400
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13403
Close 13403
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13405
Close 13405
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13406
Close 13406
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13409
Close 13409
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13413
Close 13413
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13417
Close 13417
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13421
Close 13421
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13425
Close 13425
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13429
Close 13429
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13432
Close 13432
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13436
Close 13436
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13440
Close 13440
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13442
Close 13442
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13443
Close 13443
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13452
Close 13452
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13453
FIND_FIRST \clients\client1\~dmtmp\*
Close 13453
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13454
Close 13454
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13455
ReadX 13455 0 4096 4096
Close 13455
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13456
ReadX 13456 0 4096 4096
Close 13456
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13457
ReadX 13457 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13467
Close 13467
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13468
FIND_FIRST \clients\client1\~dmtmp\*
Close 13468
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13469
Close 13469
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13470
ReadX 13470 0 4096 4096
Close 13470
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13471
ReadX 13471 0 4096 4096
Close 13471
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13472
ReadX 13472 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13473
ReadX 13473 0 65471 65471
ReadX 13473 65471 65 65
ReadX 13473 65536 65471 65471
ReadX 13473 131007 65 65
ReadX 13473 131072 65471 65471
ReadX 13473 196543 65 65
ReadX 13473 196608 65471 65471
ReadX 13473 262079 65 65
ReadX 13473 262144 65471 65471
ReadX 13473 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13474
ReadX 13474 0 65471 65471
ReadX 13474 65471 65 65
ReadX 13474 65536 65471 65471
ReadX 13474 131007 65 65
ReadX 13474 131072 65471 65471
ReadX 13474 196543 65 65
ReadX 13474 196608 65471 65471
ReadX 13474 262079 65 65
ReadX 13474 262144 65471 65471
ReadX 13474 327615 65 65
ReadX 13474 327680 65471 65471
ReadX 13474 393151 65 65
ReadX 13474 393216 65471 65471
ReadX 13474 458687 65 65
ReadX 13474 458752 65471 65471
ReadX 13474 524223 65 65
ReadX 13474 524288 65471 65471
ReadX 13474 589759 65 65
ReadX 13474 589824 65471 65471
ReadX 13474 655295 65 65
ReadX 13474 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13475
ReadX 13475 0 65471 65471
ReadX 13475 65471 65 65
ReadX 13475 65536 65471 65471
ReadX 13475 131007 65 65
ReadX 13475 131072 65471 65471
ReadX 13475 196543 65 65
ReadX 13475 196608 65471 65471
ReadX 13475 262079 65 65
ReadX 13475 262144 65471 65471
ReadX 13475 327615 65 65
ReadX 13475 327680 65471 65471
ReadX 13475 393151 65 65
ReadX 13475 393216 65471 65471
ReadX 13475 458687 65 65
ReadX 13475 458752 65471 65471
ReadX 13475 524223 65 65
ReadX 13475 524288 65471 65471
ReadX 13475 589759 65 65
ReadX 13475 589824 65471 65471
ReadX 13475 655295 65 65
ReadX 13475 655360 65471 65471
ReadX 13475 720831 65 65
ReadX 13475 720896 65471 65471
ReadX 13475 786367 65 65
ReadX 13475 786432 65471 65471
ReadX 13475 851903 65 65
ReadX 13475 851968 65471 65471
ReadX 13475 917439 65 65
ReadX 13475 917504 65471 65471
ReadX 13475 982975 65 65
ReadX 13475 983040 65471 65471
ReadX 13475 1048511 65 65
ReadX 13475 1048576 65471 65471
ReadX 13475 1114047 65 65
ReadX 13475 1114112 65471 65471
ReadX 13475 1179583 65 65
ReadX 13475 1179648 65471 65471
ReadX 13475 1245119 65 65
ReadX 13475 1245184 65471 65471
ReadX 13475 1310655 65 65
ReadX 13475 1310720 65471 65471
ReadX 13475 1376191 65 65
ReadX 13475 1376256 65471 65471
ReadX 13475 1441727 65 65
ReadX 13475 1441792 65471 65471
ReadX 13475 1507263 65 65
ReadX 13475 1507328 65471 65471
ReadX 13475 1572799 65 65
ReadX 13475 1572864 65471 65471
ReadX 13475 1638335 65 65
ReadX 13475 1638400 65471 65471
ReadX 13475 1703871 65 65
ReadX 13475 1703936 65471 65471
ReadX 13475 1769407 65 65
ReadX 13475 1769472 65471 65471
ReadX 13475 1834943 65 65
ReadX 13475 1835008 32768 32768
Close 13457
Close 13472
Close 13473
Close 13474
Close 13475
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13476
ReadX 13476 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13476 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13476 8192 4096 4096
ReadX 13476 12288 4096 4096
ReadX 13476 16384 4096 4096
ReadX 13476 20480 4096 4096
ReadX 13476 24576 4096 4096
ReadX 13476 28672 4096 4096
ReadX 13476 32768 4096 4096
ReadX 13476 36864 4096 4096
ReadX 13476 40960 4096 4096
ReadX 13476 45056 4096 4096
ReadX 13476 49152 4096 4096
ReadX 13476 53248 4096 4096
ReadX 13476 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13476 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13477
Close 13477
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13478
WriteX 13478 1535 1 1
QUERY_FILE_INFORMATION 13478
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13476 0 4096 4096
ReadX 13476 4096 4096 4096
QUERY_FILE_INFORMATION 13478
WriteX 13478 0 57088 57088
WriteX 13478 0 4096 4096
Flush 13478
Close 13476
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13479
Close 13479
WriteX 13478 0 4096 4096
Close 13478
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13480
Close 13480
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13481
ReadX 13481 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13481 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13482
WriteX 13482 1535 1 1
QUERY_FILE_INFORMATION 13482
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13481 0 4096 4096
QUERY_FILE_INFORMATION 13482
WriteX 13482 0 51456 51456
WriteX 13482 0 4096 4096
Flush 13482
Close 13481
WriteX 13482 0 4096 4096
Close 13482
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13483
Close 13483
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13484
ReadX 13484 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13484 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13486
Close 13486
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13488
WriteX 13488 4045 1 1
QUERY_FILE_INFORMATION 13488
WriteX 13488 0 53077 53077
Close 13488
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13489
WriteX 13489 1535 1 1
QUERY_FILE_INFORMATION 13489
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13484 0 4096 4096
QUERY_FILE_INFORMATION 13489
WriteX 13489 0 65471 65471
WriteX 13489 65471 65 65
WriteX 13489 65536 1856 1856
WriteX 13489 0 4096 4096
Flush 13489
Close 13484
WriteX 13489 0 4096 4096
Close 13489
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13490
Close 13490
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13491
ReadX 13491 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13493
Close 13493
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13495
WriteX 13495 4076 1 1
QUERY_FILE_INFORMATION 13495
WriteX 13495 0 7983 7983
Close 13495
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13497
Close 13497
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13499
WriteX 13499 4095 1 1
QUERY_FILE_INFORMATION 13499
WriteX 13499 0 65471 65471
WriteX 13499 65471 65 65
WriteX 13499 65536 65471 65471
WriteX 13499 131007 65 65
WriteX 13499 131072 65471 65471
WriteX 13499 196543 65 65
WriteX 13499 196608 65471 65471
WriteX 13499 262079 65 65
WriteX 13499 262144 65471 65471
WriteX 13499 327615 65 65
WriteX 13499 327680 65471 65471
WriteX 13499 393151 65 65
WriteX 13499 393216 65471 65471
WriteX 13499 458687 65 65
WriteX 13499 458752 46731 46731
Close 13499
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13500
WriteX 13500 1535 1 1
QUERY_FILE_INFORMATION 13500
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13491 0 4096 4096
ReadX 13491 4096 4096 4096
QUERY_FILE_INFORMATION 13500
WriteX 13500 0 65471 65471
WriteX 13500 65471 65 65
WriteX 13500 65536 22848 22848
WriteX 13500 0 4096 4096
Flush 13500
Close 13491
WriteX 13500 0 4096 4096
Close 13500
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13501
Close 13501
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13502
ReadX 13502 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13502 4096 4096 4096
Close 13502
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13503
ReadX 13503 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13503 0 8192 8192
ReadX 13503 8192 4096 4096
ReadX 13503 12288 4096 4096
ReadX 13503 16384 4096 4096
ReadX 13503 20480 4096 4096
ReadX 13503 24576 4096 4096
ReadX 13503 28672 4096 4096
ReadX 13503 32768 4096 4096
ReadX 13503 36864 4096 4096
ReadX 13503 40960 4096 4096
ReadX 13503 45056 4096 4096
ReadX 13503 49152 4096 4096
ReadX 13503 53248 4096 4096
ReadX 13503 57344 4096 4096
ReadX 13503 61440 4096 4096
ReadX 13503 65536 4096 4096
ReadX 13503 69632 4096 4096
ReadX 13503 73728 4096 4096
ReadX 13503 77824 4096 4096
ReadX 13503 81920 4096 4096
ReadX 13503 86016 4096 4096
ReadX 13503 90112 4096 4096
ReadX 13503 94208 4096 4096
ReadX 13503 98304 4096 4096
ReadX 13503 102400 4096 4096
ReadX 13503 106496 4096 4096
ReadX 13503 110592 4096 4096
ReadX 13503 114688 4096 4096
ReadX 13503 118784 4096 4096
ReadX 13503 122880 4096 4096
ReadX 13503 126976 4096 4096
ReadX 13503 131072 4096 4096
ReadX 13503 135168 4096 4096
ReadX 13503 139264 4096 4096
ReadX 13503 143360 4096 4096
ReadX 13503 147456 4096 4096
ReadX 13503 151552 4096 4096
ReadX 13503 155648 4096 4096
ReadX 13503 159744 4096 4096
ReadX 13503 163840 4096 4096
ReadX 13503 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13503 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13504
Close 13504
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13505
WriteX 13505 2047 1 1
QUERY_FILE_INFORMATION 13505
Close 13503
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13506
Close 13506
WriteX 13505 0 42388 42388
Close 13505
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13507
Close 13507
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13508
ReadX 13508 0 4096 4096
ReadX 13508 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13509
WriteX 13509 2047 1 1
QUERY_FILE_INFORMATION 13509
Close 13508
WriteX 13509 0 42652 42652
Close 13509
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13510
Close 13510
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13511
ReadX 13511 0 4096 4096
ReadX 13511 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13513
Close 13513
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13515
WriteX 13515 4080 1 1
QUERY_FILE_INFORMATION 13515
WriteX 13515 0 65471 65471
WriteX 13515 65471 65 65
WriteX 13515 65536 49 49
Close 13515
Close 13511
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13516
ReadX 13516 61440 4096 4096
ReadX 13516 126976 4096 4096
WriteX 13516 0 65471 65471
WriteX 13516 65471 65 65
WriteX 13516 65536 65471 65471
WriteX 13516 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13517
ReadX 13517 61440 4096 4096
ReadX 13517 126976 4096 4096
ReadX 13517 192512 4096 4096
ReadX 13517 258048 4096 4096
WriteX 13517 0 65471 65471
WriteX 13517 65471 65 65
WriteX 13517 65536 65471 65471
WriteX 13517 131007 65 65
WriteX 13517 131072 65471 65471
WriteX 13517 196543 65 65
WriteX 13517 196608 65471 65471
WriteX 13517 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13518
ReadX 13518 61440 4096 4096
ReadX 13518 126976 4096 4096
ReadX 13518 192512 4096 4096
ReadX 13518 258048 4096 4096
ReadX 13518 323584 4096 4096
ReadX 13518 389120 4096 4096
ReadX 13518 454656 4096 4096
ReadX 13518 520192 4096 4096
WriteX 13518 0 65471 65471
WriteX 13518 65471 65 65
WriteX 13518 65536 65471 65471
WriteX 13518 131007 65 65
WriteX 13518 131072 65471 65471
WriteX 13518 196543 65 65
WriteX 13518 196608 65471 65471
WriteX 13518 262079 65 65
WriteX 13518 262144 65471 65471
WriteX 13518 327615 65 65
WriteX 13518 327680 65471 65471
WriteX 13518 393151 65 65
WriteX 13518 393216 65471 65471
WriteX 13518 458687 65 65
WriteX 13518 458752 65471 65471
WriteX 13518 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13519
FIND_FIRST \clients\client1\~dmtmp\*
Close 13519
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13520
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13520 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13521
ReadX 13521 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13522
ReadX 13522 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13523
ReadX 13523 0 4096 4096
ReadX 13520 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13520
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13524
ReadX 13524 0 4096 4096
ReadX 13524 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13525
FIND_FIRST \clients\client1\~dmtmp\*
Close 13525
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13526
QUERY_FILE_INFORMATION 13526
WriteX 13526 2047 1 1
QUERY_FILE_INFORMATION 13526
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13527
Close 13527
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13528
WriteX 13528 52 1 1
QUERY_FILE_INFORMATION 13528
WriteX 13528 0 491 491
Close 13528
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13529
ReadX 13529 0 491 491
WriteX 13526 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13524
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13530
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13530 0 4096 4096
ReadX 13530 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13532
Close 13532
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13533
WriteX 13533 52 1 1
QUERY_FILE_INFORMATION 13533
WriteX 13533 0 543 543
Close 13533
Close 13530
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13534
ReadX 13534 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13535
ReadX 13535 0 543 543
ReadX 13534 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13534
Close 13529
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13516
Close 13517
Close 13518
Close 13535
Close 13521
Close 13522
Close 13523
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13526
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13536
FIND_FIRST \clients\client1\~dmtmp\*
Close 13536
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13537
ReadX 13537 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13538
ReadX 13538 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13539
ReadX 13539 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13540
ReadX 13540 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13541
ReadX 13541 0 543 543
ReadX 13537 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13545
FIND_FIRST \clients\client1\~dmtmp\*
Close 13545
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13546
QUERY_FILE_INFORMATION 13546
WriteX 13546 2047 1 1
QUERY_FILE_INFORMATION 13546
WriteX 13546 0 2048 2048
Close 13546
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13547
ReadX 13547 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13547
Close 13537
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13548
ReadX 13548 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13548 4095 1 1
QUERY_FILE_INFORMATION 13548
ReadX 13548 0 4096 4096
WriteX 13548 0 4096 4096
Flush 13548
WriteX 13548 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13549
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13549 0 4096 4096
ReadX 13549 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13553
FIND_FIRST \clients\client1\~dmtmp\*
Close 13553
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13554
WriteX 13554 2047 1 1
QUERY_FILE_INFORMATION 13554
WriteX 13554 0 2048 2048
Close 13554
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13555
ReadX 13555 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13559
Close 13559
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13560
WriteX 13560 2047 1 1
QUERY_FILE_INFORMATION 13560
WriteX 13560 0 2048 2048
Close 13560
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13561
ReadX 13561 0 2048 2048
ReadX 13549 4096 16384 16384
Close 13561
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13562
ReadX 13562 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 13562
Close 13541
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13555 4095 1 1
QUERY_FILE_INFORMATION 13555
ReadX 13555 0 4096 4096
WriteX 13555 0 4096 4096
Close 13555
WriteX 13549 0 8192 8192
Close 13549
WriteX 13538 0 4096 4096
WriteX 13539 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13564
ReadX 13564 0 4096 4096
ReadX 13564 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13564
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13565
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13565 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13566
ReadX 13566 0 543 543
ReadX 13565 0 4096 4096
Close 13565
Close 13548
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13567
QUERY_FILE_INFORMATION 13567
Close 13567
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13566
Close 13538
Close 13539
Close 13540
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13568
FIND_FIRST \clients\client1\~dmtmp\*
Close 13568
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13569
ReadX 13569 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13570
ReadX 13570 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13571
ReadX 13571 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13572
ReadX 13572 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13573
ReadX 13573 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13574
ReadX 13574 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13575
ReadX 13575 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13576
ReadX 13576 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13577
ReadX 13577 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13578
ReadX 13578 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13579
ReadX 13579 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13580
ReadX 13580 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13581
ReadX 13581 0 4096 4096
ReadX 13569 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13585
FIND_FIRST \clients\client1\~dmtmp\*
Close 13585
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13586
QUERY_FILE_INFORMATION 13586
WriteX 13586 2047 1 1
QUERY_FILE_INFORMATION 13586
WriteX 13586 0 2048 2048
Close 13586
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13587
ReadX 13587 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13587
Close 13577
Close 13569
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13588
ReadX 13588 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13589
FIND_FIRST \clients\client1\~dmtmp\*
Close 13589
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13590
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13590 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13591
ReadX 13591 0 4096 4096
ReadX 13590 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13595
FIND_FIRST \clients\client1\~dmtmp\*
Close 13595
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13596
QUERY_FILE_INFORMATION 13596
WriteX 13596 2047 1 1
QUERY_FILE_INFORMATION 13596
WriteX 13596 0 2048 2048
Close 13596
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13597
ReadX 13597 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13597
Close 13590
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13598
ReadX 13598 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13588 4095 1 1
QUERY_FILE_INFORMATION 13588
ReadX 13588 0 4096 4096
WriteX 13588 0 4096 4096
Flush 13588
WriteX 13598 4095 1 1
QUERY_FILE_INFORMATION 13598
ReadX 13598 0 4096 4096
WriteX 13598 0 4096 4096
Flush 13598
WriteX 13588 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 13598 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13599
ReadX 13599 0 4096 4096
ReadX 13591 0 4096 4096
ReadX 13599 0 4096 4096
ReadX 13599 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13600
FIND_FIRST \clients\client1\~dmtmp\*
Close 13600
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13601
WriteX 13601 4095 1 1
QUERY_FILE_INFORMATION 13601
WriteX 13601 0 4096 4096
Close 13601
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13602
ReadX 13602 0 4096 4096
Close 13599
Close 13591
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13603
Close 13603
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13604
WriteX 13604 4095 1 1
QUERY_FILE_INFORMATION 13604
WriteX 13604 0 4096 4096
Close 13604
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13605
ReadX 13605 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 13605 0 4096 4096
Close 13602
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13581
Close 13575
Close 13578
Close 13579
Close 13580
Close 13576
Close 13570
Close 13573
Close 13574
Close 13571
Close 13572
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13605
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13607
Close 13607
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13608
ReadX 13608 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13609
Close 13609
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13610
WriteX 13610 2047 1 1
QUERY_FILE_INFORMATION 13610
WriteX 13610 0 2048 2048
Close 13610
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13611
ReadX 13611 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13611
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13612
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13612 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13613
ReadX 13613 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13614
ReadX 13614 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13615
ReadX 13615 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13616
ReadX 13616 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13617
ReadX 13617 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13618
ReadX 13618 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13619
ReadX 13619 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13620
ReadX 13620 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13621
ReadX 13621 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13622
ReadX 13622 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13623
ReadX 13623 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13624
ReadX 13624 0 4096 4096
ReadX 13612 0 4096 4096
ReadX 13619 0 4096 4096
Close 13619
Close 13612
Close 13588
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13625
QUERY_FILE_INFORMATION 13625
Close 13625
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13608
Close 13623
Close 13618
Close 13620
Close 13621
Close 13622
Close 13624
Close 13613
Close 13616
Close 13617
Close 13614
Close 13615
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13598
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13626
QUERY_FILE_INFORMATION 13626
Close 13626
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13627
FIND_FIRST \clients\client1\~dmtmp\*
Close 13627
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13628
ReadX 13628 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13629
ReadX 13629 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13630
ReadX 13630 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13631
ReadX 13631 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13632
ReadX 13632 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13633
ReadX 13633 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13634
ReadX 13634 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13635
ReadX 13635 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13636
ReadX 13636 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13637
ReadX 13637 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13638
ReadX 13638 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13639
ReadX 13639 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13640
ReadX 13640 0 4096 4096
ReadX 13628 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13644
FIND_FIRST \clients\client1\~dmtmp\*
Close 13644
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13645
QUERY_FILE_INFORMATION 13645
WriteX 13645 2047 1 1
QUERY_FILE_INFORMATION 13645
WriteX 13645 0 2048 2048
Close 13645
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13646
ReadX 13646 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13646
Close 13628
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13647
ReadX 13647 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13648
FIND_FIRST \clients\client1\~dmtmp\*
Close 13648
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13649
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13649 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13650
ReadX 13650 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13651
ReadX 13651 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13652
ReadX 13652 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13653
ReadX 13653 0 543 543
ReadX 13649 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13657
FIND_FIRST \clients\client1\~dmtmp\*
Close 13657
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 2047 1 1
QUERY_FILE_INFORMATION 13658
WriteX 13658 0 2048 2048
Close 13658
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13659
ReadX 13659 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13659
Close 13649
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13660
ReadX 13660 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 13633
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13661
FIND_FIRST \clients\client1\~dmtmp\*
Close 13661
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13662
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13662 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13663
ReadX 13663 0 4096 4096
ReadX 13662 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13667
FIND_FIRST \clients\client1\~dmtmp\*
Close 13667
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13668
QUERY_FILE_INFORMATION 13668
WriteX 13668 2047 1 1
QUERY_FILE_INFORMATION 13668
WriteX 13668 0 2048 2048
Close 13668
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13669
ReadX 13669 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13669
Close 13663
Close 13662
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13670
ReadX 13670 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13647 4095 1 1
QUERY_FILE_INFORMATION 13647
ReadX 13647 0 4096 4096
WriteX 13647 0 4096 4096
Flush 13647
WriteX 13660 4095 1 1
QUERY_FILE_INFORMATION 13660
ReadX 13660 0 4096 4096
WriteX 13660 0 4096 4096
Flush 13660
WriteX 13670 4095 1 1
QUERY_FILE_INFORMATION 13670
ReadX 13670 0 4096 4096
WriteX 13670 0 4096 4096
Flush 13670
WriteX 13647 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 13660 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 13670 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13671
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13671 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13672
ReadX 13672 0 4096 4096
ReadX 13671 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13673
ReadX 13673 0 4096 4096
ReadX 13673 0 4096 4096
ReadX 13673 4096 16384 16384
ReadX 13671 4096 16384 16384
ReadX 13671 0 4096 4096
ReadX 13672 0 4096 4096
ReadX 13672 4096 4096 4096
Close 13673
Close 13672
Close 13671
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13674
FIND_FIRST \clients\client1\~dmtmp\*
Close 13674
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13675
ReadX 13675 0 2048 2048
WriteX 13675 18431 1 1
QUERY_FILE_INFORMATION 13675
WriteX 13675 0 19584 19584
Close 13675
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13676
ReadX 13676 0 4096 4096
ReadX 13676 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13676
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13677
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13677 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13678
ReadX 13678 0 4096 4096
ReadX 13677 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13679
ReadX 13679 0 4096 4096
ReadX 13679 0 4096 4096
Close 13679
Close 13678
Close 13677
Close 13647
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13680
QUERY_FILE_INFORMATION 13680
Close 13680
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13653
Close 13640
Close 13632
Close 13650
Close 13651
Close 13652
Close 13639
Close 13634
Close 13637
Close 13638
Close 13635
Close 13636
Close 13629
Close 13630
Close 13631
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13660
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13681
QUERY_FILE_INFORMATION 13681
Close 13681
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13670
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13682
QUERY_FILE_INFORMATION 13682
Close 13682
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13683
FIND_FIRST \clients\client1\~dmtmp\*
Close 13683
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13684
ReadX 13684 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13685
ReadX 13685 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13686
ReadX 13686 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13687
ReadX 13687 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13688
ReadX 13688 0 543 543
ReadX 13684 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13684 4096 16384 16384
WriteX 13684 0 4096 4096
Close 13684
WriteX 13685 0 4096 4096
WriteX 13686 0 4096 4096
WriteX 13687 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13689
FIND_FIRST \clients\client1\~dmtmp\*
Close 13689
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13690
ReadX 13690 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13691
ReadX 13691 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13692
ReadX 13692 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13693
ReadX 13693 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13694
ReadX 13694 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13695
ReadX 13695 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13696
ReadX 13696 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13697
ReadX 13697 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13698
ReadX 13698 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13699
ReadX 13699 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13700
ReadX 13700 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13701
ReadX 13701 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13702
ReadX 13702 0 4096 4096
ReadX 13690 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13703
ReadX 13703 0 8192 8192
ReadX 13690 4096 16384 16384
Close 13697
Close 13690
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13704
FIND_FIRST \clients\client1\~dmtmp\*
Close 13704
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13705
ReadX 13705 0 4096 4096
ReadX 13705 4096 4096 4096
ReadX 13705 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13706
ReadX 13706 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13707
ReadX 13707 0 4096 4096
ReadX 13706 0 4096 4096
ReadX 13706 0 4096 4096
ReadX 13706 4096 16384 16384
Close 13707
WriteX 13706 0 4096 4096
Close 13706
WriteX 13691 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13708
FIND_FIRST \clients\client1\~dmtmp\*
Close 13708
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13709
ReadX 13709 0 4096 4096
ReadX 13709 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13710
ReadX 13710 0 4096 4096
ReadX 13710 0 4096 4096
WriteX 13710 0 4096 4096
Close 13710
WriteX 13685 0 4096 4096
WriteX 13686 0 4096 4096
WriteX 13687 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13711
ReadX 13711 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13712
ReadX 13712 0 4096 4096
ReadX 13711 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13716
FIND_FIRST \clients\client1\~dmtmp\*
Close 13716
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13717
QUERY_FILE_INFORMATION 13717
WriteX 13717 2047 1 1
QUERY_FILE_INFORMATION 13717
WriteX 13717 0 2048 2048
Close 13717
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13718
ReadX 13718 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13718 4095 1 1
QUERY_FILE_INFORMATION 13718
ReadX 13718 0 4096 4096
WriteX 13718 0 4096 4096
Close 13718
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13719
ReadX 13719 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13719 0 4096 4096
Close 13712
Close 13711
WriteX 13719 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13720
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13720 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13721
ReadX 13721 0 4096 4096
ReadX 13720 0 4096 4096
ReadX 13720 4096 16384 16384
Close 13721
Close 13720
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13722
FIND_FIRST \clients\client1\~dmtmp\*
Close 13722
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13723
ReadX 13723 0 4096 4096
ReadX 13723 4096 4096 4096
WriteX 13723 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13723 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13723
ReadX 13719 0 4096 4096
WriteX 13719 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13724
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13724 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13725
ReadX 13725 0 4096 4096
ReadX 13724 0 4096 4096
ReadX 13724 4096 16384 16384
Close 13725
Close 13724
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13726
FIND_FIRST \clients\client1\~dmtmp\*
Close 13726
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13727
ReadX 13727 0 4096 4096
ReadX 13727 4096 4096 4096
WriteX 13727 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13727 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13727
Close 13719
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13728
QUERY_FILE_INFORMATION 13728
Close 13728
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 13703
Close 13705
Close 13709
Close 13688
Close 13685
Close 13686
Close 13687
Close 13696
Close 13701
Close 13698
Close 13699
Close 13700
Close 13702
Close 13691
Close 13694
Close 13695
Close 13692
Close 13693
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13729
FIND_FIRST \clients\client1\~dmtmp\*
Close 13729
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13730
ReadX 13730 0 4096 4096
ReadX 13730 4096 4096 4096
ReadX 13730 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13731
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13731 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13732
ReadX 13732 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13733
ReadX 13733 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13734
ReadX 13734 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13735
ReadX 13735 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13736
ReadX 13736 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13737
ReadX 13737 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13738
ReadX 13738 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13739
ReadX 13739 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13740
ReadX 13740 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13741
ReadX 13741 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13742
ReadX 13742 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13743
ReadX 13743 0 4096 4096
ReadX 13731 0 4096 4096
ReadX 13731 0 4096 4096
ReadX 13731 4096 16384 16384
Close 13738
Close 13731
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13744
ReadX 13744 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13745
ReadX 13745 0 4096 4096
ReadX 13744 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13749
FIND_FIRST \clients\client1\~dmtmp\*
Close 13749
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13750
QUERY_FILE_INFORMATION 13750
WriteX 13750 2047 1 1
QUERY_FILE_INFORMATION 13750
WriteX 13750 0 2048 2048
Close 13750
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13751
ReadX 13751 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13751 4095 1 1
QUERY_FILE_INFORMATION 13751
ReadX 13751 0 4096 4096
WriteX 13751 0 4096 4096
Close 13751
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13752
ReadX 13752 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13752 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13756
Close 13756
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13757
QUERY_FILE_INFORMATION 13757
WriteX 13757 2047 1 1
QUERY_FILE_INFORMATION 13757
WriteX 13757 0 2048 2048
Close 13757
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13758
ReadX 13758 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13758 4095 1 1
QUERY_FILE_INFORMATION 13758
ReadX 13758 0 4096 4096
WriteX 13758 0 4096 4096
Close 13758
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13759
ReadX 13759 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13759 0 4096 4096
Close 13744
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13760
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13760 0 4096 4096
ReadX 13760 0 4096 4096
ReadX 13760 4096 16384 16384
Close 13760
Close 13752
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13761
QUERY_FILE_INFORMATION 13761
Close 13761
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13730
Close 13742
Close 13737
Close 13743
Close 13745
Close 13732
Close 13735
Close 13736
Close 13733
Close 13734
Close 13739
Close 13740
Close 13741
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13759
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13762
QUERY_FILE_INFORMATION 13762
Close 13762
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13763
ReadX 13763 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13764
Close 13764
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13765
WriteX 13765 63 1 1
QUERY_FILE_INFORMATION 13765
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13763 0 4096 4096
ReadX 13763 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13763 0 8192 8192
Flush 13763
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13763 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13763 0 8192 8192
Flush 13763
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13763 0 8192 8192
Flush 13763
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13763 0 8192 8192
Flush 13763
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13767
Close 13767
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13769
WriteX 13769 4065 1 1
QUERY_FILE_INFORMATION 13769
WriteX 13769 0 62591 62591
Close 13769
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13771
Close 13771
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13773
WriteX 13773 4094 1 1
QUERY_FILE_INFORMATION 13773
WriteX 13773 0 10845 10845
Close 13773
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13775
Close 13775
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13777
WriteX 13777 4081 1 1
QUERY_FILE_INFORMATION 13777
WriteX 13777 0 30118 30118
Close 13777
WriteX 13763 0 4096 4096
Close 13763
WriteX 13765 0 64 64
Close 13765
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13778
ReadX 13778 61440 4096 4096
ReadX 13778 126976 4096 4096
WriteX 13778 0 65471 65471
WriteX 13778 65471 65 65
WriteX 13778 65536 65471 65471
WriteX 13778 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13779
ReadX 13779 61440 4096 4096
ReadX 13779 126976 4096 4096
ReadX 13779 192512 4096 4096
ReadX 13779 258048 4096 4096
WriteX 13779 0 65471 65471
WriteX 13779 65471 65 65
WriteX 13779 65536 65471 65471
WriteX 13779 131007 65 65
WriteX 13779 131072 65471 65471
WriteX 13779 196543 65 65
WriteX 13779 196608 65471 65471
WriteX 13779 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13780
ReadX 13780 61440 4096 4096
ReadX 13780 126976 4096 4096
ReadX 13780 192512 4096 4096
ReadX 13780 258048 4096 4096
ReadX 13780 323584 4096 4096
ReadX 13780 389120 4096 4096
ReadX 13780 454656 4096 4096
ReadX 13780 520192 4096 4096
WriteX 13780 0 65471 65471
WriteX 13780 65471 65 65
WriteX 13780 65536 65471 65471
WriteX 13780 131007 65 65
WriteX 13780 131072 65471 65471
WriteX 13780 196543 65 65
WriteX 13780 196608 65471 65471
WriteX 13780 262079 65 65
WriteX 13780 262144 65471 65471
WriteX 13780 327615 65 65
WriteX 13780 327680 65471 65471
WriteX 13780 393151 65 65
WriteX 13780 393216 65471 65471
WriteX 13780 458687 65 65
WriteX 13780 458752 65471 65471
WriteX 13780 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13781
Close 13781
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13778
Close 13779
Close 13780
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13782
ReadX 13782 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13783
ReadX 13783 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13784
ReadX 13784 0 4096 4096
ReadX 13784 4096 4096 4096
ReadX 13784 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13785
Close 13785
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13782
Close 13783
Close 13784
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13786
Close 13786
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13787
ReadX 13787 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13788
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13788
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13789
Close 13789
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13790
ReadX 13790 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13791
Close 13791
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13787
Close 13790
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13792
Close 13792
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13793
ReadX 13793 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13794
ReadX 13794 0 8192 8192
ReadX 13794 8192 8192 8192
ReadX 13794 16384 8192 8192
ReadX 13794 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13796
Close 13796
Close 13793
Close 13794
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13798
WriteX 13798 8191 1 1
QUERY_FILE_INFORMATION 13798
WriteX 13798 0 10438 10438
Close 13798
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13799
Close 13799
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13800
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13801
Close 13801
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13802
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13803
Close 13803
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13804
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13805
FIND_FIRST \clients\client1\~dmtmp\*
Close 13805
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13806
Close 13806
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13807
ReadX 13807 0 4096 4096
Close 13807
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13808
ReadX 13808 0 8192 8192
Close 13808
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13809
ReadX 13809 0 8192 8192
ReadX 13809 8192 4096 4096
ReadX 13809 12288 8192 8192
ReadX 13809 20480 8192 8192
ReadX 13809 28672 8192 8192
ReadX 13809 36864 8192 8192
ReadX 13809 45056 8192 8192
ReadX 13809 53248 8192 8192
ReadX 13809 61440 8192 8192
ReadX 13809 69632 8192 8192
ReadX 13809 77824 8192 8192
ReadX 13809 86016 8192 8192
ReadX 13809 94208 8192 8192
ReadX 13809 102400 8192 8192
ReadX 13809 110592 8192 8192
ReadX 13809 118784 8192 8192
ReadX 13809 126976 8192 8192
ReadX 13809 135168 8192 8192
ReadX 13809 143360 8192 8192
ReadX 13809 151552 8192 8192
ReadX 13809 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13810
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13810
Close 13809
Close 13800
Close 13802
Close 13804
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13811
Close 13811
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13813
WriteX 13813 8191 1 1
QUERY_FILE_INFORMATION 13813
WriteX 13813 0 28489 28489
Close 13813
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13814
Close 13814
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13815
FIND_FIRST \clients\client1\~dmtmp\*
Close 13815
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13816
Close 13816
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13817
ReadX 13817 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13818
Close 13818
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13817
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13819
Close 13819
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13820
ReadX 13820 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13821
ReadX 13821 0 8192 8192
ReadX 13821 8192 8192 8192
ReadX 13821 16384 8192 8192
ReadX 13821 24576 8192 8192
ReadX 13821 32768 16384 16384
ReadX 13821 49152 8192 8192
ReadX 13821 57344 8192 8192
ReadX 13821 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13823
Close 13823
Close 13820
Close 13821
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13825
WriteX 13825 8191 1 1
QUERY_FILE_INFORMATION 13825
WriteX 13825 0 29253 29253
Close 13825
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13826
Close 13826
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13827
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13828
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13828
Close 13827
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13829
Close 13829
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13831
WriteX 13831 8191 1 1
QUERY_FILE_INFORMATION 13831
WriteX 13831 0 30183 30183
Close 13831
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13832
Close 13832
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13833
WriteX 13833 0 510 510
WriteX 13833 510 512 512
WriteX 13833 1022 510 510
WriteX 13833 1532 510 510
WriteX 13833 2042 168 168
Close 13833
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13834
Close 13834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13835
ReadX 13835 0 4096 4096
WriteX 13835 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13836
ReadX 13836 0 65471 65471
ReadX 13836 65471 65 65
ReadX 13836 65536 65471 65471
ReadX 13836 131007 65 65
ReadX 13836 131072 65471 65471
ReadX 13836 196543 65 65
ReadX 13836 196608 65471 65471
ReadX 13836 262079 65 65
ReadX 13836 262144 65471 65471
ReadX 13836 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13837
ReadX 13837 0 65471 65471
ReadX 13837 65471 65 65
ReadX 13837 65536 65471 65471
ReadX 13837 131007 65 65
ReadX 13837 131072 65471 65471
ReadX 13837 196543 65 65
ReadX 13837 196608 65471 65471
ReadX 13837 262079 65 65
ReadX 13837 262144 65471 65471
ReadX 13837 327615 65 65
ReadX 13837 327680 65471 65471
ReadX 13837 393151 65 65
ReadX 13837 393216 65471 65471
ReadX 13837 458687 65 65
ReadX 13837 458752 65471 65471
ReadX 13837 524223 65 65
ReadX 13837 524288 65471 65471
ReadX 13837 589759 65 65
ReadX 13837 589824 65471 65471
ReadX 13837 655295 65 65
ReadX 13837 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13838
ReadX 13838 0 65471 65471
ReadX 13838 65471 65 65
ReadX 13838 65536 65471 65471
ReadX 13838 131007 65 65
ReadX 13838 131072 65471 65471
ReadX 13838 196543 65 65
ReadX 13838 196608 65471 65471
ReadX 13838 262079 65 65
ReadX 13838 262144 65471 65471
ReadX 13838 327615 65 65
ReadX 13838 327680 65471 65471
ReadX 13838 393151 65 65
ReadX 13838 393216 65471 65471
ReadX 13838 458687 65 65
ReadX 13838 458752 65471 65471
ReadX 13838 524223 65 65
ReadX 13838 524288 65471 65471
ReadX 13838 589759 65 65
ReadX 13838 589824 65471 65471
ReadX 13838 655295 65 65
ReadX 13838 655360 65471 65471
ReadX 13838 720831 65 65
ReadX 13838 720896 65471 65471
ReadX 13838 786367 65 65
ReadX 13838 786432 65471 65471
ReadX 13838 851903 65 65
ReadX 13838 851968 65471 65471
ReadX 13838 917439 65 65
ReadX 13838 917504 65471 65471
ReadX 13838 982975 65 65
ReadX 13838 983040 65471 65471
ReadX 13838 1048511 65 65
ReadX 13838 1048576 65471 65471
ReadX 13838 1114047 65 65
ReadX 13838 1114112 65471 65471
ReadX 13838 1179583 65 65
ReadX 13838 1179648 65471 65471
ReadX 13838 1245119 65 65
ReadX 13838 1245184 65471 65471
ReadX 13838 1310655 65 65
ReadX 13838 1310720 65471 65471
ReadX 13838 1376191 65 65
ReadX 13838 1376256 65471 65471
ReadX 13838 1441727 65 65
ReadX 13838 1441792 65471 65471
ReadX 13838 1507263 65 65
ReadX 13838 1507328 65471 65471
ReadX 13838 1572799 65 65
ReadX 13838 1572864 65471 65471
ReadX 13838 1638335 65 65
ReadX 13838 1638400 65471 65471
ReadX 13838 1703871 65 65
ReadX 13838 1703936 65471 65471
ReadX 13838 1769407 65 65
ReadX 13838 1769472 65471 65471
ReadX 13838 1834943 65 65
ReadX 13838 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13839
ReadX 13839 0 4096 4096
ReadX 13839 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13840
WriteX 13840 52 1 1
QUERY_FILE_INFORMATION 13840
WriteX 13840 0 53 53
Close 13840
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13841
Close 13841
Close 13835
Close 13836
Close 13837
Close 13838
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13839 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13842
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13839 0 4096 4096
ReadX 13839 4096 4096 4096
ReadX 13839 8192 4096 4096
ReadX 13839 12288 4096 4096
WriteX 13842 15359 1 1
QUERY_FILE_INFORMATION 13842
ReadX 13839 16384 4096 4096
ReadX 13839 20480 4096 4096
WriteX 13842 0 15360 15360
Close 13842
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13843
ReadX 13843 0 4096 4096
WriteX 13843 0 4096 4096
Close 13843
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13844
Close 13844
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13845
ReadX 13845 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13846
Close 13846
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13839
ReadX 13845 0 4096 4096
ReadX 13845 4096 4096 4096
ReadX 13845 8192 4096 4096
ReadX 13845 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13847
ReadX 13847 0 4096 4096
ReadX 13847 0 4096 4096
ReadX 13847 4096 4096 4096
ReadX 13847 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13848
ReadX 13848 0 4096 4096
ReadX 13848 4096 4096 4096
ReadX 13848 8192 4096 4096
Close 13847
Close 13848
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13849
WriteX 13849 15359 1 1
QUERY_FILE_INFORMATION 13849
WriteX 13849 0 15360 15360
Close 13849
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13850
ReadX 13850 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13845
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13851
Close 13851
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13852
ReadX 13852 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13853
Close 13853
WriteX 13850 0 4096 4096
Close 13850
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13854
Close 13854
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13855
ReadX 13855 0 4096 4096
ReadX 13855 0 4096 4096
ReadX 13855 4096 4096 4096
ReadX 13855 8192 4096 4096
ReadX 13855 12288 3072 3072
ReadX 13855 0 8192 8192
ReadX 13855 8192 4096 4096
ReadX 13855 12288 3072 3072
WriteX 13855 15469 1 1
QUERY_FILE_INFORMATION 13855
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13856
ReadX 13856 0 4096 4096
ReadX 13856 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13857
WriteX 13857 52 1 1
QUERY_FILE_INFORMATION 13857
WriteX 13857 0 53 53
Close 13857
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13858
Close 13858
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13859
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13856 0 8192 8192
ReadX 13856 8192 4096 4096
ReadX 13856 12288 4096 4096
WriteX 13859 12005 1 1
QUERY_FILE_INFORMATION 13859
WriteX 13859 0 12006 12006
Close 13859
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13860
ReadX 13860 0 4096 4096
WriteX 13860 0 4096 4096
Close 13860
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13861
Close 13861
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13862
ReadX 13862 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13863
Close 13863
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13856
ReadX 13862 0 4096 4096
ReadX 13862 4096 4096 4096
ReadX 13862 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13864
WriteX 13864 11990 1 1
QUERY_FILE_INFORMATION 13864
WriteX 13864 0 11991 11991
Close 13864
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13865
ReadX 13865 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13862
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13866
Close 13866
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13867
ReadX 13867 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13868
Close 13868
WriteX 13865 0 4096 4096
Close 13865
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13869
Close 13869
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13870
ReadX 13870 0 4096 4096
ReadX 13870 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
WriteX 13855 0 19054 19054
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13871
Close 13871
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13870 0 8192 8192
ReadX 13870 8192 3799 3799
WriteX 13870 13247 1 1
QUERY_FILE_INFORMATION 13870
WriteX 13870 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13870 0 8192 8192
ReadX 13870 8192 4096 4096
Close 13852
Close 13855
WriteX 13870 0 12288 12288
Close 13870
Close 13867
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13872
Close 13872
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13873
Close 13873
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13874
ReadX 13874 61440 4096 4096
ReadX 13874 126976 4096 4096
WriteX 13874 0 65471 65471
WriteX 13874 65471 65 65
WriteX 13874 65536 65471 65471
WriteX 13874 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13875
ReadX 13875 61440 4096 4096
ReadX 13875 126976 4096 4096
ReadX 13875 192512 4096 4096
ReadX 13875 258048 4096 4096
WriteX 13875 0 65471 65471
WriteX 13875 65471 65 65
WriteX 13875 65536 65471 65471
WriteX 13875 131007 65 65
WriteX 13875 131072 65471 65471
WriteX 13875 196543 65 65
WriteX 13875 196608 65471 65471
WriteX 13875 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13876
ReadX 13876 61440 4096 4096
ReadX 13876 126976 4096 4096
ReadX 13876 192512 4096 4096
ReadX 13876 258048 4096 4096
ReadX 13876 323584 4096 4096
ReadX 13876 389120 4096 4096
ReadX 13876 454656 4096 4096
ReadX 13876 520192 4096 4096
WriteX 13876 0 65471 65471
WriteX 13876 65471 65 65
WriteX 13876 65536 65471 65471
WriteX 13876 131007 65 65
WriteX 13876 131072 65471 65471
WriteX 13876 196543 65 65
WriteX 13876 196608 65471 65471
WriteX 13876 262079 65 65
WriteX 13876 262144 65471 65471
WriteX 13876 327615 65 65
WriteX 13876 327680 65471 65471
WriteX 13876 393151 65 65
WriteX 13876 393216 65471 65471
WriteX 13876 458687 65 65
WriteX 13876 458752 65471 65471
WriteX 13876 524223 65 65
Close 13874
Close 13875
Close 13876
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13877
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13877 0 4096 4096
Close 13877
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13878
ReadX 13878 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13878
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13879
ReadX 13879 0 4096 4096
ReadX 13879 4096 4096 4096
ReadX 13879 8192 4096 4096
ReadX 13879 12288 4096 4096
ReadX 13879 16384 4096 4096
ReadX 13879 20480 4096 4096
ReadX 13879 24576 4096 4096
ReadX 13879 28672 4096 4096
ReadX 13879 32768 4096 4096
ReadX 13879 36864 4096 4096
ReadX 13879 40960 4096 4096
ReadX 13879 45056 4096 4096
ReadX 13879 49152 4096 4096
ReadX 13879 53248 4096 4096
ReadX 13879 57344 4096 4096
ReadX 13879 61440 4096 4096
ReadX 13879 65536 4096 4096
ReadX 13879 69632 4096 4096
ReadX 13879 73728 4096 4096
WriteX 13879 0 4096 4096
Close 13879
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13880
Close 13880
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13881
ReadX 13881 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13882
Close 13882
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13881
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13884
WriteX 13884 4607 1 1
QUERY_FILE_INFORMATION 13884
WriteX 13884 0 65471 65471
WriteX 13884 65471 65 65
WriteX 13884 65536 19979 19979
Close 13884
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13885
ReadX 13885 0 4096 4096
WriteX 13885 0 4096 4096
Flush 13885
WriteX 13885 0 4096 4096
Flush 13885
QUERY_FILE_INFORMATION 13885
WriteX 13885 0 4096 4096
Flush 13885
WriteX 13885 0 4096 4096
Flush 13885
WriteX 13885 0 4096 4096
Flush 13885
WriteX 13885 0 4096 4096
Flush 13885
Close 13885
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13886
ReadX 13886 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13887
ReadX 13887 0 4096 4096
Close 13886
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13888
ReadX 13888 0 4096 4096
Close 13888
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13889
ReadX 13889 0 4096 4096
Close 13889
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13890
ReadX 13890 0 4096 4096
WriteX 13890 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13891
Close 13891
Close 13887
Close 13890
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13892
Close 13892
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13894
WriteX 13894 4607 1 1
QUERY_FILE_INFORMATION 13894
WriteX 13894 0 65471 65471
WriteX 13894 65471 65 65
WriteX 13894 65536 17654 17654
Close 13894
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13895
ReadX 13895 0 4096 4096
WriteX 13895 0 4096 4096
Flush 13895
WriteX 13895 0 4096 4096
Flush 13895
QUERY_FILE_INFORMATION 13895
WriteX 13895 0 4096 4096
Flush 13895
WriteX 13895 0 4096 4096
Flush 13895
WriteX 13895 0 4096 4096
Flush 13895
WriteX 13895 0 4096 4096
Flush 13895
Close 13895
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13896
Close 13896
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13897
ReadX 13897 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13898
Close 13898
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13899
ReadX 13899 0 4096 4096
ReadX 13899 4096 4096 4096
ReadX 13899 8192 4096 4096
ReadX 13899 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13899 16384 4096 4096
ReadX 13899 20480 4096 4096
ReadX 13899 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13897
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13900
ReadX 13900 0 4096 4096
Close 13900
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13901
ReadX 13901 0 4096 4096
Close 13901
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13902
ReadX 13902 0 4096 4096
WriteX 13902 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13903
Close 13903
Close 13902
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13904
Close 13904
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13906
WriteX 13906 4607 1 1
QUERY_FILE_INFORMATION 13906
WriteX 13906 0 65471 65471
WriteX 13906 65471 65 65
WriteX 13906 65536 19490 19490
Close 13906
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13907
ReadX 13907 0 4096 4096
WriteX 13907 0 4096 4096
Flush 13907
WriteX 13907 0 4096 4096
Flush 13907
QUERY_FILE_INFORMATION 13907
WriteX 13907 0 4096 4096
Flush 13907
WriteX 13907 0 4096 4096
Flush 13907
WriteX 13907 0 4096 4096
Flush 13907
WriteX 13907 0 4096 4096
Flush 13907
Close 13907
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13908
Close 13908
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13909
ReadX 13909 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13910
Close 13910
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13909
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13911
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13911 0 4096 4096
Close 13911
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13912
ReadX 13912 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13912
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13913
ReadX 13913 0 4096 4096
ReadX 13913 4096 4096 4096
ReadX 13913 8192 4096 4096
ReadX 13913 12288 4096 4096
ReadX 13913 16384 4096 4096
ReadX 13913 20480 4096 4096
ReadX 13913 24576 4096 4096
ReadX 13913 28672 4096 4096
ReadX 13913 32768 4096 4096
ReadX 13913 36864 4096 4096
ReadX 13913 40960 4096 4096
ReadX 13913 45056 4096 4096
ReadX 13913 49152 4096 4096
ReadX 13913 53248 4096 4096
ReadX 13913 57344 4096 4096
ReadX 13913 61440 4096 4096
ReadX 13913 65536 4096 4096
ReadX 13913 69632 4096 4096
ReadX 13913 73728 4096 4096
WriteX 13913 0 4096 4096
Close 13913
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13914
Close 13914
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13915
ReadX 13915 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13916
Close 13916
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13915
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13918
WriteX 13918 4607 1 1
QUERY_FILE_INFORMATION 13918
WriteX 13918 0 65471 65471
WriteX 13918 65471 65 65
WriteX 13918 65536 8866 8866
Close 13918
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13919
ReadX 13919 0 4096 4096
WriteX 13919 0 4096 4096
Flush 13919
WriteX 13919 0 4096 4096
Flush 13919
Close 13919
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13920
ReadX 13920 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13920
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13921
ReadX 13921 0 4096 4096
Close 13921
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13922
ReadX 13922 0 4096 4096
Close 13922
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13923
ReadX 13923 0 4096 4096
WriteX 13923 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13924
Close 13924
Close 13923
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13925
Close 13925
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13927
WriteX 13927 4607 1 1
QUERY_FILE_INFORMATION 13927
WriteX 13927 0 65471 65471
WriteX 13927 65471 65 65
WriteX 13927 65536 9298 9298
Close 13927
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13928
ReadX 13928 0 4096 4096
WriteX 13928 0 4096 4096
Flush 13928
WriteX 13928 0 4096 4096
Flush 13928
Close 13928
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13929
Close 13929
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13930
ReadX 13930 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13931
Close 13931
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13933
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13933 0 4096 4096
Close 13933
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13934
ReadX 13934 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13934 4096 4096 4096
ReadX 13934 8192 4096 4096
ReadX 13934 12288 4096 4096
ReadX 13934 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13930
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13935
ReadX 13935 0 4096 4096
Close 13935
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13936
ReadX 13936 0 4096 4096
Close 13936
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13937
ReadX 13937 0 4096 4096
WriteX 13937 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13938
Close 13938
Close 13934
Close 13937
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13939
Close 13939
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13941
WriteX 13941 4607 1 1
QUERY_FILE_INFORMATION 13941
WriteX 13941 0 65471 65471
WriteX 13941 65471 65 65
WriteX 13941 65536 11540 11540
Close 13941
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13942
ReadX 13942 0 4096 4096
WriteX 13942 0 4096 4096
Flush 13942
WriteX 13942 0 4096 4096
Flush 13942
Close 13942
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13943
Close 13943
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13944
ReadX 13944 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13945
Close 13945
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13944
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13946
ReadX 13946 0 65471 65471
ReadX 13946 65471 65 65
ReadX 13946 65536 65471 65471
ReadX 13946 131007 65 65
ReadX 13946 131072 65471 65471
ReadX 13946 196543 65 65
ReadX 13946 196608 65471 65471
ReadX 13946 262079 65 65
ReadX 13946 262144 65471 65471
ReadX 13946 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13947
ReadX 13947 0 65471 65471
ReadX 13947 65471 65 65
ReadX 13947 65536 65471 65471
ReadX 13947 131007 65 65
ReadX 13947 131072 65471 65471
ReadX 13947 196543 65 65
ReadX 13947 196608 65471 65471
ReadX 13947 262079 65 65
ReadX 13947 262144 65471 65471
ReadX 13947 327615 65 65
ReadX 13947 327680 65471 65471
ReadX 13947 393151 65 65
ReadX 13947 393216 65471 65471
ReadX 13947 458687 65 65
ReadX 13947 458752 65471 65471
ReadX 13947 524223 65 65
ReadX 13947 524288 65471 65471
ReadX 13947 589759 65 65
ReadX 13947 589824 65471 65471
ReadX 13947 655295 65 65
ReadX 13947 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13948
ReadX 13948 0 65471 65471
ReadX 13948 65471 65 65
ReadX 13948 65536 65471 65471
ReadX 13948 131007 65 65
ReadX 13948 131072 65471 65471
ReadX 13948 196543 65 65
ReadX 13948 196608 65471 65471
ReadX 13948 262079 65 65
ReadX 13948 262144 65471 65471
ReadX 13948 327615 65 65
ReadX 13948 327680 65471 65471
ReadX 13948 393151 65 65
ReadX 13948 393216 65471 65471
ReadX 13948 458687 65 65
ReadX 13948 458752 65471 65471
ReadX 13948 524223 65 65
ReadX 13948 524288 65471 65471
ReadX 13948 589759 65 65
ReadX 13948 589824 65471 65471
ReadX 13948 655295 65 65
ReadX 13948 655360 65471 65471
ReadX 13948 720831 65 65
ReadX 13948 720896 65471 65471
ReadX 13948 786367 65 65
ReadX 13948 786432 65471 65471
ReadX 13948 851903 65 65
ReadX 13948 851968 65471 65471
ReadX 13948 917439 65 65
ReadX 13948 917504 65471 65471
ReadX 13948 982975 65 65
ReadX 13948 983040 65471 65471
ReadX 13948 1048511 65 65
ReadX 13948 1048576 65471 65471
ReadX 13948 1114047 65 65
ReadX 13948 1114112 65471 65471
ReadX 13948 1179583 65 65
ReadX 13948 1179648 65471 65471
ReadX 13948 1245119 65 65
ReadX 13948 1245184 65471 65471
ReadX 13948 1310655 65 65
ReadX 13948 1310720 65471 65471
ReadX 13948 1376191 65 65
ReadX 13948 1376256 65471 65471
ReadX 13948 1441727 65 65
ReadX 13948 1441792 65471 65471
ReadX 13948 1507263 65 65
ReadX 13948 1507328 65471 65471
ReadX 13948 1572799 65 65
ReadX 13948 1572864 65471 65471
ReadX 13948 1638335 65 65
ReadX 13948 1638400 65471 65471
ReadX 13948 1703871 65 65
ReadX 13948 1703936 65471 65471
ReadX 13948 1769407 65 65
ReadX 13948 1769472 65471 65471
ReadX 13948 1834943 65 65
ReadX 13948 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13949
FIND_FIRST \clients\client1\~dmtmp\*
Close 13949
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13950
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13951
QUERY_FILE_INFORMATION 13951
QUERY_FILE_INFORMATION 13951
QUERY_FILE_INFORMATION 13951
ReadX 13951 2156 24 24
ReadX 13951 2139 276 276
ReadX 13951 2136 14 14
ReadX 13951 2136 7 7
ReadX 13951 2138 12 12
ReadX 13951 2137 8 8
ReadX 13951 2135 15 15
ReadX 13951 0 16 16
ReadX 13951 16 2048 2048
ReadX 13951 2064 2048 2048
ReadX 13951 257 2048 2048
ReadX 13951 385 2048 2048
ReadX 13951 513 2048 2048
ReadX 13951 641 2048 2048
ReadX 13951 769 2048 2048
ReadX 13951 897 2048 2048
ReadX 13951 1025 2048 2048
ReadX 13951 1153 2048 2048
ReadX 13951 1281 2048 2048
ReadX 13951 1409 2048 2048
ReadX 13951 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13953
Close 13953
Close 13899
Close 13946
Close 13947
Close 13948
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13955
WriteX 13955 15 1 1
QUERY_FILE_INFORMATION 13955
WriteX 13955 0 10575 10575
Flush 13955
Close 13955
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13956
Close 13956
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13957
ReadX 13957 0 4096 4096
Close 13951
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13958
Close 13958
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13959
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13960
QUERY_FILE_INFORMATION 13960
ReadX 13960 0 512 512
ReadX 13960 512 512 512
ReadX 13960 1024 512 512
QUERY_FILE_INFORMATION 13960
QUERY_FILE_INFORMATION 13960
Close 13960
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13961
QUERY_FILE_INFORMATION 13961
ReadX 13961 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13962
QUERY_FILE_INFORMATION 13962
ReadX 13962 0 512 512
ReadX 13962 512 512 512
ReadX 13962 1024 512 512
ReadX 13962 288 20 20
ReadX 13962 308 2084 2084
ReadX 13962 388 2084 2084
ReadX 13962 388 2084 2084
ReadX 13950 2157 1386 1386
ReadX 13962 2472 399 399
ReadX 13962 3072 1536 1536
ReadX 13962 544 149 149
ReadX 13962 693 485 485
Close 13962
ReadX 13950 2157 4096 4096
ReadX 13950 6253 4096 4096
ReadX 13950 10349 4096 4096
ReadX 13950 14445 4096 4096
ReadX 13950 18541 4096 4096
ReadX 13950 22637 256 256
ReadX 13950 22893 4096 4096
ReadX 13950 26989 4096 4096
ReadX 13950 31085 4096 4096
ReadX 13950 35181 4096 4096
ReadX 13950 39277 4096 4096
ReadX 13950 43373 4096 4096
ReadX 13950 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13950 2157 1024 1024
ReadX 13950 1667 4688 4688
ReadX 13950 6355 3516 3516
ReadX 13950 9871 16384 16384
ReadX 13950 26255 3771 3771
ReadX 13950 30026 2048 2048
ReadX 13950 32074 1024 1024
ReadX 13950 33098 6652 6652
ReadX 13950 39750 16384 16384
ReadX 13950 56134 10496 10496
ReadX 13950 66630 1784 1784
ReadX 13950 68414 90 90
ReadX 13950 68504 273 273
ReadX 13950 68777 1600 1600
ReadX 13950 70377 640 640
ReadX 13950 71017 1280 1280
ReadX 13950 72297 8464 8464
ReadX 13950 80761 158 158
ReadX 13950 80919 912 912
ReadX 13950 81831 1980 1980
ReadX 13950 83811 2256 2256
ReadX 13950 86067 400 400
ReadX 13950 86467 252 252
ReadX 13950 86719 42 42
ReadX 13950 86761 725 725
ReadX 13950 2009 512 512
ReadX 13950 3895 9 9
ReadX 13950 3781 46 46
ReadX 13950 4059 92 92
ReadX 13950 3781 92 92
ReadX 13950 3986 184 184
ReadX 13950 3987 16384 16384
ReadX 13950 3902 16384 16384
ReadX 13950 3781 10240 10240
ReadX 13950 3821 16384 16384
ReadX 13950 3891 935 935
ReadX 13950 4060 10240 10240
ReadX 13950 4059 184 184
ReadX 13950 256 184 184
ReadX 13950 256 1026 1026
ReadX 13950 3901 326 326
ReadX 13950 3899 652 652
ReadX 13950 256 2 2
ReadX 13950 258 4948 4948
Close 13950
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13964
Close 13964
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13966
WriteX 13966 4055 1 1
QUERY_FILE_INFORMATION 13966
WriteX 13966 0 65471 65471
WriteX 13966 65471 65 65
WriteX 13966 65536 65471 65471
WriteX 13966 131007 65 65
WriteX 13966 131072 65471 65471
WriteX 13966 196543 65 65
WriteX 13966 196608 65471 65471
WriteX 13966 262079 65 65
WriteX 13966 262144 65471 65471
WriteX 13966 327615 65 65
WriteX 13966 327680 65471 65471
WriteX 13966 393151 65 65
WriteX 13966 393216 65471 65471
WriteX 13966 458687 65 65
WriteX 13966 458752 65471 65471
WriteX 13966 524223 65 65
WriteX 13966 524288 65471 65471
WriteX 13966 589759 65 65
WriteX 13966 589824 35257 35257
Close 13966
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13968
Close 13968
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13970
WriteX 13970 4055 1 1
QUERY_FILE_INFORMATION 13970
WriteX 13970 0 65471 65471
WriteX 13970 65471 65 65
WriteX 13970 65536 65471 65471
WriteX 13970 131007 65 65
WriteX 13970 131072 65471 65471
WriteX 13970 196543 65 65
WriteX 13970 196608 65471 65471
WriteX 13970 262079 65 65
WriteX 13970 262144 65471 65471
WriteX 13970 327615 65 65
WriteX 13970 327680 65471 65471
WriteX 13970 393151 65 65
WriteX 13970 393216 65471 65471
WriteX 13970 458687 65 65
WriteX 13970 458752 65471 65471
WriteX 13970 524223 65 65
WriteX 13970 524288 65471 65471
WriteX 13970 589759 65 65
WriteX 13970 589824 57598 57598
Close 13970
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13972
WriteX 13972 15 1 1
QUERY_FILE_INFORMATION 13972
WriteX 13972 0 12543 12543
Flush 13972
Close 13972
Close 13957
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13973
Close 13973
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13974
ReadX 13974 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13975
FIND_FIRST \clients\client1\~dmtmp\*
Close 13975
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13976
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13977
QUERY_FILE_INFORMATION 13977
QUERY_FILE_INFORMATION 13977
QUERY_FILE_INFORMATION 13977
ReadX 13977 1938 24 24
ReadX 13977 1920 276 276
ReadX 13977 1918 14 14
ReadX 13977 1918 7 7
ReadX 13977 1919 12 12
ReadX 13977 1919 8 8
ReadX 13977 1917 15 15
ReadX 13977 0 16 16
ReadX 13977 16 2048 2048
ReadX 13977 2064 2048 2048
ReadX 13977 257 2048 2048
ReadX 13977 385 2048 2048
ReadX 13977 513 2048 2048
ReadX 13977 641 2048 2048
ReadX 13977 769 2048 2048
ReadX 13977 897 2048 2048
ReadX 13977 1025 2048 2048
ReadX 13977 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13979
Close 13979
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13981
WriteX 13981 15 1 1
QUERY_FILE_INFORMATION 13981
WriteX 13981 0 11588 11588
Flush 13981
Close 13981
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13982
Close 13982
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13983
ReadX 13983 0 4096 4096
Close 13977
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13985
WriteX 13985 15 1 1
QUERY_FILE_INFORMATION 13985
WriteX 13985 0 11615 11615
Flush 13985
Close 13985
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13986
Close 13986
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13987
ReadX 13987 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13989
Close 13989
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13991
WriteX 13991 4088 1 1
QUERY_FILE_INFORMATION 13991
WriteX 13991 0 65471 65471
WriteX 13991 65471 65 65
WriteX 13991 65536 16050 16050
Close 13991
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13976 1939 64 64
ReadX 13976 128 248 248
ReadX 13976 128 568 568
ReadX 13976 3872 1536 1536
ReadX 13976 3456 2560 2560
ReadX 13976 3136 512 512
ReadX 13976 2880 4096 4096
ReadX 13976 3264 3072 3072
ReadX 13976 320 4096 4096
ReadX 13976 1024 4096 4096
ReadX 13976 3616 4096 4096
ReadX 13976 1939 64 64
ReadX 13976 128 248 248
ReadX 13976 128 608 608
ReadX 13976 2858 1024 1024
ReadX 13976 2810 4096 4096
ReadX 13976 2826 4096 4096
ReadX 13976 2580 2048 2048
ReadX 13976 2800 2560 2560
ReadX 13976 2100 4096 4096
ReadX 13976 2084 4096 4096
ReadX 13976 868 4096 4096
ReadX 13976 2324 4096 4096
ReadX 13976 884 4096 4096
ReadX 13976 2604 1024 1024
ReadX 13976 580 4096 4096
ReadX 13976 596 4096 4096
ReadX 13976 2752 4096 4096
ReadX 13976 2842 1024 1024
ReadX 13976 660 4096 4096
ReadX 13976 2720 4096 4096
ReadX 13976 2736 4096 4096
ReadX 13976 628 4096 4096
ReadX 13976 2704 4096 4096
ReadX 13976 1556 4096 4096
ReadX 13976 576 4096 4096
ReadX 13976 3168 1536 1536
ReadX 13976 832 4096 4096
ReadX 13976 1088 4096 4096
ReadX 13976 1344 4096 4096
ReadX 13976 1600 4096 4096
ReadX 13976 1856 4096 4096
ReadX 13976 2112 4096 4096
ReadX 13976 1892 4096 4096
ReadX 13976 820 4096 4096
ReadX 13976 788 4096 4096
ReadX 13976 1604 4096 4096
ReadX 13976 3648 4096 4096
ReadX 13976 2608 4096 4096
ReadX 13976 548 4096 4096
ReadX 13976 740 4096 4096
ReadX 13976 1344 4096 4096
ReadX 13976 3392 4096 4096
ReadX 13976 3904 4096 4096
ReadX 13976 644 4096 4096
ReadX 13976 676 4096 4096
ReadX 13976 2688 4096 4096
ReadX 13976 320 4096 4096
ReadX 13976 900 4096 4096
ReadX 13976 1908 4096 4096
ReadX 13976 852 4096 4096
ReadX 13976 724 4096 4096
ReadX 13976 2292 4096 4096
ReadX 13976 612 4096 4096
ReadX 13976 388 4096 4096
ReadX 13976 2368 4096 4096
ReadX 13976 2624 4096 4096
ReadX 13976 500 4096 4096
ReadX 13976 356 4096 4096
ReadX 13976 1024 4096 4096
ReadX 13976 576 4096 4096
ReadX 13976 340 4096 4096
ReadX 13976 420 4096 4096
ReadX 13976 1600 4096 4096
ReadX 13976 404 4096 4096
ReadX 13976 1428 4096 4096
ReadX 13976 2656 4096 4096
ReadX 13976 2624 4096 4096
ReadX 13976 452 4096 4096
ReadX 13976 692 4096 4096
ReadX 13976 564 4096 4096
ReadX 13976 372 4096 4096
ReadX 13976 468 4096 4096
ReadX 13976 484 4096 4096
ReadX 13976 1088 4096 4096
ReadX 13976 1924 4096 4096
ReadX 13976 2768 4096 4096
ReadX 13976 832 4096 4096
ReadX 13976 836 4096 4096
ReadX 13976 1856 4096 4096
ReadX 13976 2640 4096 4096
ReadX 13976 436 4096 4096
ReadX 13976 1828 4096 4096
ReadX 13976 804 4096 4096
ReadX 13976 1860 4096 4096
ReadX 13976 1812 4096 4096
ReadX 13976 756 4096 4096
ReadX 13976 1636 4096 4096
ReadX 13976 772 4096 4096
ReadX 13976 2036 4096 4096
ReadX 13976 1220 4096 4096
ReadX 13976 1652 4096 4096
ReadX 13976 2588 4096 4096
ReadX 13976 916 4096 4096
ReadX 13976 260 4096 4096
ReadX 13976 932 4096 4096
ReadX 13976 2624 4096 4096
ReadX 13976 308 4096 4096
ReadX 13976 292 4096 4096
ReadX 13976 1140 4096 4096
ReadX 13976 276 4096 4096
ReadX 13976 2020 4096 4096
ReadX 13976 2880 4096 4096
ReadX 13976 516 4096 4096
ReadX 13976 1844 4096 4096
ReadX 13976 1124 4096 4096
ReadX 13976 3136 4096 4096
ReadX 13976 324 4096 4096
ReadX 13976 1156 4096 4096
ReadX 13976 1172 4096 4096
ReadX 13976 2112 4096 4096
ReadX 13976 2368 4096 4096
ReadX 13976 964 4096 4096
ReadX 13976 980 4096 4096
ReadX 13976 1012 4096 4096
ReadX 13976 532 4096 4096
ReadX 13976 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13976 1620 4096 4096
ReadX 13976 1604 4096 4096
ReadX 13976 2116 4096 4096
ReadX 13976 2132 4096 4096
ReadX 13976 2148 4096 4096
ReadX 13976 2276 4096 4096
ReadX 13976 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13993
Close 13993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13995
QUERY_FILE_INFORMATION 13959
Close 13959
WriteX 13995 4088 1 1
QUERY_FILE_INFORMATION 13995
QUERY_FILE_INFORMATION 13961
Close 13961
WriteX 13995 0 65471 65471
WriteX 13995 65471 65 65
WriteX 13995 65536 64850 64850
Close 13995
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13997
WriteX 13997 15 1 1
QUERY_FILE_INFORMATION 13997
ReadX 13976 2068 4096 4096
ReadX 13976 1588 4096 4096
ReadX 13976 1572 4096 4096
WriteX 13997 0 18630 18630
Flush 13997
Close 13997
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13998
Close 13998
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13999
ReadX 13999 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13976 612 4096 4096
ReadX 13976 564 4096 4096
ReadX 13976 1876 4096 4096
ReadX 13976 628 4096 4096
ReadX 13976 740 4096 4096
ReadX 13976 724 4096 4096
ReadX 13976 644 4096 4096
ReadX 13976 2324 4096 4096
ReadX 13976 660 4096 4096
ReadX 13976 852 4096 4096
ReadX 13976 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13976 2368 4096 4096
ReadX 13976 1024 4096 4096
ReadX 13976 320 4096 4096
ReadX 13976 580 4096 4096
ReadX 13976 3136 512 512
ReadX 13976 2880 4096 4096
Close 13976
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14000
ReadX 14000 61440 4096 4096
ReadX 14000 126976 4096 4096
WriteX 14000 0 65471 65471
WriteX 14000 65471 65 65
WriteX 14000 65536 65471 65471
WriteX 14000 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14001
ReadX 14001 61440 4096 4096
ReadX 14001 126976 4096 4096
ReadX 14001 192512 4096 4096
ReadX 14001 258048 4096 4096
WriteX 14001 0 65471 65471
WriteX 14001 65471 65 65
WriteX 14001 65536 65471 65471
WriteX 14001 131007 65 65
WriteX 14001 131072 65471 65471
WriteX 14001 196543 65 65
WriteX 14001 196608 65471 65471
WriteX 14001 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14002
ReadX 14002 61440 4096 4096
ReadX 14002 126976 4096 4096
ReadX 14002 192512 4096 4096
ReadX 14002 258048 4096 4096
ReadX 14002 323584 4096 4096
ReadX 14002 389120 4096 4096
ReadX 14002 454656 4096 4096
ReadX 14002 520192 4096 4096
WriteX 14002 0 65471 65471
WriteX 14002 65471 65 65
WriteX 14002 65536 65471 65471
WriteX 14002 131007 65 65
WriteX 14002 131072 65471 65471
WriteX 14002 196543 65 65
WriteX 14002 196608 65471 65471
WriteX 14002 262079 65 65
WriteX 14002 262144 65471 65471
WriteX 14002 327615 65 65
WriteX 14002 327680 65471 65471
WriteX 14002 393151 65 65
WriteX 14002 393216 65471 65471
WriteX 14002 458687 65 65
WriteX 14002 458752 65471 65471
WriteX 14002 524223 65 65
Close 13999
Close 13974
Close 14000
Close 14001
Close 14002
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14003
Close 14003
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14004
Close 14004
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14007
Close 14007
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 14009
Close 14009
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 14010
Close 14010
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14013
Close 14013
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14015
Close 14015
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14016
Close 14016
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14019
Close 14019
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14023
Close 14023
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14027
Close 14027
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14031
Close 14031
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14035
Close 14035
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14039
Close 14039
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14043
Close 14043
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 14047
Close 14047
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 14049
Close 14049
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 14051
Close 14051
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 14053
WriteX 14053 4095 1 1
QUERY_FILE_INFORMATION 14053
QUERY_FS_INFORMATION 259
WriteX 14053 0 65471 65471
WriteX 14053 65471 65 65
WriteX 14053 65536 65471 65471
WriteX 14053 131007 65 65
WriteX 14053 131072 65471 65471
WriteX 14053 196543 65 65
WriteX 14053 196608 65471 65471
WriteX 14053 262079 65 65
WriteX 14053 262144 26634 26634
Close 14053
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14058
Close 14058
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14059
Close 14059
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14060
ReadX 14060 0 4096 4096
Close 14060
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14061
ReadX 14061 0 4096 4096
ReadX 14061 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14062
Close 14062
Close 14061
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14065
Close 14065
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14067
Close 14067
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14068
Close 14068
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 14071
Close 14071
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 14073
Close 14073
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14074
Close 14074
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14077
Close 14077
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14081
Close 14081
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14085
Close 14085
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14089
Close 14089
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14093
Close 14093
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12038
Close 12038
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12041
Close 12041
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12045
Close 12045
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12049
Close 12049
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 12051
Close 12051
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 12052
Close 12052
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12061
Close 12061
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12062
FIND_FIRST \clients\client1\~dmtmp\*
Close 12062
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12063
Close 12063
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12064
ReadX 12064 0 4096 4096
Close 12064
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12065
ReadX 12065 0 4096 4096
Close 12065
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12066
ReadX 12066 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12076
Close 12076
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12077
FIND_FIRST \clients\client1\~dmtmp\*
Close 12077
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12078
Close 12078
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12079
ReadX 12079 0 4096 4096
Close 12079
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12080
ReadX 12080 0 4096 4096
Close 12080
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12081
ReadX 12081 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12082
ReadX 12082 0 65471 65471
ReadX 12082 65471 65 65
ReadX 12082 65536 65471 65471
ReadX 12082 131007 65 65
ReadX 12082 131072 65471 65471
ReadX 12082 196543 65 65
ReadX 12082 196608 65471 65471
ReadX 12082 262079 65 65
ReadX 12082 262144 65471 65471
ReadX 12082 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12083
ReadX 12083 0 65471 65471
ReadX 12083 65471 65 65
ReadX 12083 65536 65471 65471
ReadX 12083 131007 65 65
ReadX 12083 131072 65471 65471
ReadX 12083 196543 65 65
ReadX 12083 196608 65471 65471
ReadX 12083 262079 65 65
ReadX 12083 262144 65471 65471
ReadX 12083 327615 65 65
ReadX 12083 327680 65471 65471
ReadX 12083 393151 65 65
ReadX 12083 393216 65471 65471
ReadX 12083 458687 65 65
ReadX 12083 458752 65471 65471
ReadX 12083 524223 65 65
ReadX 12083 524288 65471 65471
ReadX 12083 589759 65 65
ReadX 12083 589824 65471 65471
ReadX 12083 655295 65 65
ReadX 12083 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12084
ReadX 12084 0 65471 65471
ReadX 12084 65471 65 65
ReadX 12084 65536 65471 65471
ReadX 12084 131007 65 65
ReadX 12084 131072 65471 65471
ReadX 12084 196543 65 65
ReadX 12084 196608 65471 65471
ReadX 12084 262079 65 65
ReadX 12084 262144 65471 65471
ReadX 12084 327615 65 65
ReadX 12084 327680 65471 65471
ReadX 12084 393151 65 65
ReadX 12084 393216 65471 65471
ReadX 12084 458687 65 65
ReadX 12084 458752 65471 65471
ReadX 12084 524223 65 65
ReadX 12084 524288 65471 65471
ReadX 12084 589759 65 65
ReadX 12084 589824 65471 65471
ReadX 12084 655295 65 65
ReadX 12084 655360 65471 65471
ReadX 12084 720831 65 65
ReadX 12084 720896 65471 65471
ReadX 12084 786367 65 65
ReadX 12084 786432 65471 65471
ReadX 12084 851903 65 65
ReadX 12084 851968 65471 65471
ReadX 12084 917439 65 65
ReadX 12084 917504 65471 65471
ReadX 12084 982975 65 65
ReadX 12084 983040 65471 65471
ReadX 12084 1048511 65 65
ReadX 12084 1048576 65471 65471
ReadX 12084 1114047 65 65
ReadX 12084 1114112 65471 65471
ReadX 12084 1179583 65 65
ReadX 12084 1179648 65471 65471
ReadX 12084 1245119 65 65
ReadX 12084 1245184 65471 65471
ReadX 12084 1310655 65 65
ReadX 12084 1310720 65471 65471
ReadX 12084 1376191 65 65
ReadX 12084 1376256 65471 65471
ReadX 12084 1441727 65 65
ReadX 12084 1441792 65471 65471
ReadX 12084 1507263 65 65
ReadX 12084 1507328 65471 65471
ReadX 12084 1572799 65 65
ReadX 12084 1572864 65471 65471
ReadX 12084 1638335 65 65
ReadX 12084 1638400 65471 65471
ReadX 12084 1703871 65 65
ReadX 12084 1703936 65471 65471
ReadX 12084 1769407 65 65
ReadX 12084 1769472 65471 65471
ReadX 12084 1834943 65 65
ReadX 12084 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12085
ReadX 12085 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12085 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12085 8192 4096 4096
ReadX 12085 12288 4096 4096
ReadX 12085 16384 4096 4096
ReadX 12085 20480 4096 4096
ReadX 12085 24576 4096 4096
ReadX 12085 28672 4096 4096
ReadX 12085 32768 4096 4096
ReadX 12085 36864 4096 4096
ReadX 12085 40960 4096 4096
ReadX 12085 45056 4096 4096
ReadX 12085 49152 4096 4096
ReadX 12085 53248 4096 4096
ReadX 12085 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12085 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 12086
Close 12086
Close 12066
Close 12081
Close 12082
Close 12083
Close 12084
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 12087
WriteX 12087 1535 1 1
QUERY_FILE_INFORMATION 12087
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12085 0 4096 4096
ReadX 12085 4096 4096 4096
QUERY_FILE_INFORMATION 12087
WriteX 12087 0 57088 57088
WriteX 12087 0 4096 4096
Flush 12087
Close 12085
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12088
Close 12088
WriteX 12087 0 4096 4096
Close 12087
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 12089
Close 12089
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12090
ReadX 12090 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12090 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 12091
WriteX 12091 1535 1 1
QUERY_FILE_INFORMATION 12091
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12090 0 4096 4096
QUERY_FILE_INFORMATION 12091
WriteX 12091 0 51456 51456
WriteX 12091 0 4096 4096
Flush 12091
Close 12090
WriteX 12091 0 4096 4096
Close 12091
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 12092
Close 12092
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12093
ReadX 12093 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12093 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12095
Close 12095
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12097
WriteX 12097 4045 1 1
QUERY_FILE_INFORMATION 12097
WriteX 12097 0 53077 53077
Close 12097
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 12098
WriteX 12098 1535 1 1
QUERY_FILE_INFORMATION 12098
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12093 0 4096 4096
QUERY_FILE_INFORMATION 12098
WriteX 12098 0 65471 65471
WriteX 12098 65471 65 65
WriteX 12098 65536 1856 1856
WriteX 12098 0 4096 4096
Flush 12098
Close 12093
WriteX 12098 0 4096 4096
Close 12098
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 12099
Close 12099
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12100
ReadX 12100 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12102
Close 12102
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12104
WriteX 12104 4076 1 1
QUERY_FILE_INFORMATION 12104
WriteX 12104 0 7983 7983
Close 12104
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12106
Close 12106
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12108
WriteX 12108 4095 1 1
QUERY_FILE_INFORMATION 12108
WriteX 12108 0 65471 65471
WriteX 12108 65471 65 65
WriteX 12108 65536 65471 65471
WriteX 12108 131007 65 65
WriteX 12108 131072 65471 65471
WriteX 12108 196543 65 65
WriteX 12108 196608 65471 65471
WriteX 12108 262079 65 65
WriteX 12108 262144 65471 65471
WriteX 12108 327615 65 65
WriteX 12108 327680 65471 65471
WriteX 12108 393151 65 65
WriteX 12108 393216 65471 65471
WriteX 12108 458687 65 65
WriteX 12108 458752 46731 46731
Close 12108
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 12109
WriteX 12109 1535 1 1
QUERY_FILE_INFORMATION 12109
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12100 0 4096 4096
ReadX 12100 4096 4096 4096
QUERY_FILE_INFORMATION 12109
WriteX 12109 0 65471 65471
WriteX 12109 65471 65 65
WriteX 12109 65536 22848 22848
WriteX 12109 0 4096 4096
Flush 12109
Close 12100
WriteX 12109 0 4096 4096
Close 12109
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 12110
Close 12110
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12111
ReadX 12111 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12111 4096 4096 4096
Close 12111
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12112
ReadX 12112 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12112 0 8192 8192
ReadX 12112 8192 4096 4096
ReadX 12112 12288 4096 4096
ReadX 12112 16384 4096 4096
ReadX 12112 20480 4096 4096
ReadX 12112 24576 4096 4096
ReadX 12112 28672 4096 4096
ReadX 12112 32768 4096 4096
ReadX 12112 36864 4096 4096
ReadX 12112 40960 4096 4096
ReadX 12112 45056 4096 4096
ReadX 12112 49152 4096 4096
ReadX 12112 53248 4096 4096
ReadX 12112 57344 4096 4096
ReadX 12112 61440 4096 4096
ReadX 12112 65536 4096 4096
ReadX 12112 69632 4096 4096
ReadX 12112 73728 4096 4096
ReadX 12112 77824 4096 4096
ReadX 12112 81920 4096 4096
ReadX 12112 86016 4096 4096
ReadX 12112 90112 4096 4096
ReadX 12112 94208 4096 4096
ReadX 12112 98304 4096 4096
ReadX 12112 102400 4096 4096
ReadX 12112 106496 4096 4096
ReadX 12112 110592 4096 4096
ReadX 12112 114688 4096 4096
ReadX 12112 118784 4096 4096
ReadX 12112 122880 4096 4096
ReadX 12112 126976 4096 4096
ReadX 12112 131072 4096 4096
ReadX 12112 135168 4096 4096
ReadX 12112 139264 4096 4096
ReadX 12112 143360 4096 4096
ReadX 12112 147456 4096 4096
ReadX 12112 151552 4096 4096
ReadX 12112 155648 4096 4096
ReadX 12112 159744 4096 4096
ReadX 12112 163840 4096 4096
ReadX 12112 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12112 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 12113
Close 12113
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 12114
WriteX 12114 2047 1 1
QUERY_FILE_INFORMATION 12114
Close 12112
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12115
Close 12115
WriteX 12114 0 42388 42388
Close 12114
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 12116
Close 12116
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12117
ReadX 12117 0 4096 4096
ReadX 12117 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 12118
WriteX 12118 2047 1 1
QUERY_FILE_INFORMATION 12118
Close 12117
WriteX 12118 0 42652 42652
Close 12118
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 12119
Close 12119
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12120
ReadX 12120 0 4096 4096
ReadX 12120 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12122
Close 12122
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12124
WriteX 12124 4080 1 1
QUERY_FILE_INFORMATION 12124
WriteX 12124 0 65471 65471
WriteX 12124 65471 65 65
WriteX 12124 65536 49 49
Close 12124
Close 12120
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12125
ReadX 12125 61440 4096 4096
ReadX 12125 126976 4096 4096
WriteX 12125 0 65471 65471
WriteX 12125 65471 65 65
WriteX 12125 65536 65471 65471
WriteX 12125 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12126
ReadX 12126 61440 4096 4096
ReadX 12126 126976 4096 4096
ReadX 12126 192512 4096 4096
ReadX 12126 258048 4096 4096
WriteX 12126 0 65471 65471
WriteX 12126 65471 65 65
WriteX 12126 65536 65471 65471
WriteX 12126 131007 65 65
WriteX 12126 131072 65471 65471
WriteX 12126 196543 65 65
WriteX 12126 196608 65471 65471
WriteX 12126 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12127
ReadX 12127 61440 4096 4096
ReadX 12127 126976 4096 4096
ReadX 12127 192512 4096 4096
ReadX 12127 258048 4096 4096
ReadX 12127 323584 4096 4096
ReadX 12127 389120 4096 4096
ReadX 12127 454656 4096 4096
ReadX 12127 520192 4096 4096
WriteX 12127 0 65471 65471
WriteX 12127 65471 65 65
WriteX 12127 65536 65471 65471
WriteX 12127 131007 65 65
WriteX 12127 131072 65471 65471
WriteX 12127 196543 65 65
WriteX 12127 196608 65471 65471
WriteX 12127 262079 65 65
WriteX 12127 262144 65471 65471
WriteX 12127 327615 65 65
WriteX 12127 327680 65471 65471
WriteX 12127 393151 65 65
WriteX 12127 393216 65471 65471
WriteX 12127 458687 65 65
WriteX 12127 458752 65471 65471
WriteX 12127 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12128
FIND_FIRST \clients\client1\~dmtmp\*
Close 12128
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12129
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12129 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12130
ReadX 12130 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12131
ReadX 12131 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12132
ReadX 12132 0 4096 4096
ReadX 12129 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12129
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12133
ReadX 12133 0 4096 4096
ReadX 12133 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12134
FIND_FIRST \clients\client1\~dmtmp\*
Close 12134
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 12135
QUERY_FILE_INFORMATION 12135
WriteX 12135 2047 1 1
QUERY_FILE_INFORMATION 12135
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 12136
Close 12136
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12137
WriteX 12137 52 1 1
QUERY_FILE_INFORMATION 12137
WriteX 12137 0 491 491
Close 12137
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12138
ReadX 12138 0 491 491
WriteX 12135 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 12133
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12139
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12139 0 4096 4096
ReadX 12139 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 12141
Close 12141
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12142
WriteX 12142 52 1 1
QUERY_FILE_INFORMATION 12142
WriteX 12142 0 543 543
Close 12142
Close 12139
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12143
ReadX 12143 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12144
ReadX 12144 0 543 543
ReadX 12143 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12143
Close 12138
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12125
Close 12126
Close 12127
Close 12144
Close 12130
Close 12131
Close 12132
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12135
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12145
FIND_FIRST \clients\client1\~dmtmp\*
Close 12145
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12146
ReadX 12146 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12147
ReadX 12147 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12148
ReadX 12148 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12149
ReadX 12149 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12150
ReadX 12150 0 543 543
ReadX 12146 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 12154
FIND_FIRST \clients\client1\~dmtmp\*
Close 12154
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12155
QUERY_FILE_INFORMATION 12155
WriteX 12155 2047 1 1
QUERY_FILE_INFORMATION 12155
WriteX 12155 0 2048 2048
Close 12155
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12156
ReadX 12156 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12156
Close 12146
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12157
ReadX 12157 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 12157 4095 1 1
QUERY_FILE_INFORMATION 12157
ReadX 12157 0 4096 4096
WriteX 12157 0 4096 4096
Flush 12157
WriteX 12157 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12158
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12158 0 4096 4096
ReadX 12158 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 12162
FIND_FIRST \clients\client1\~dmtmp\*
Close 12162
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12163
WriteX 12163 2047 1 1
QUERY_FILE_INFORMATION 12163
WriteX 12163 0 2048 2048
Close 12163
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12164
ReadX 12164 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 12168
Close 12168
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12169
WriteX 12169 2047 1 1
QUERY_FILE_INFORMATION 12169
WriteX 12169 0 2048 2048
Close 12169
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12170
ReadX 12170 0 2048 2048
ReadX 12158 4096 16384 16384
Close 12170
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12171
ReadX 12171 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 12171
Close 12150
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 12164 4095 1 1
QUERY_FILE_INFORMATION 12164
ReadX 12164 0 4096 4096
WriteX 12164 0 4096 4096
Close 12164
WriteX 12158 0 8192 8192
Close 12158
WriteX 12147 0 4096 4096
WriteX 12148 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12173
ReadX 12173 0 4096 4096
ReadX 12173 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12173
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12174
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12174 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12175
ReadX 12175 0 543 543
ReadX 12174 0 4096 4096
Close 12174
Close 12157
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12176
QUERY_FILE_INFORMATION 12176
Close 12176
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12175
Close 12147
Close 12148
Close 12149
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12177
FIND_FIRST \clients\client1\~dmtmp\*
Close 12177
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12178
ReadX 12178 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12179
ReadX 12179 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12180
ReadX 12180 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12181
ReadX 12181 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12182
ReadX 12182 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12183
ReadX 12183 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12184
ReadX 12184 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12185
ReadX 12185 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12186
ReadX 12186 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12187
ReadX 12187 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12188
ReadX 12188 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12189
ReadX 12189 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12190
ReadX 12190 0 4096 4096
ReadX 12178 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12194
FIND_FIRST \clients\client1\~dmtmp\*
Close 12194
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12195
QUERY_FILE_INFORMATION 12195
WriteX 12195 2047 1 1
QUERY_FILE_INFORMATION 12195
WriteX 12195 0 2048 2048
Close 12195
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12196
ReadX 12196 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12196
Close 12186
Close 12178
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12197
ReadX 12197 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12198
FIND_FIRST \clients\client1\~dmtmp\*
Close 12198
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12199
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12199 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12200
ReadX 12200 0 4096 4096
ReadX 12199 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12204
FIND_FIRST \clients\client1\~dmtmp\*
Close 12204
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12205
QUERY_FILE_INFORMATION 12205
WriteX 12205 2047 1 1
QUERY_FILE_INFORMATION 12205
WriteX 12205 0 2048 2048
Close 12205
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12206
ReadX 12206 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12206
Close 12199
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12207
ReadX 12207 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12197 4095 1 1
QUERY_FILE_INFORMATION 12197
ReadX 12197 0 4096 4096
WriteX 12197 0 4096 4096
Flush 12197
WriteX 12207 4095 1 1
QUERY_FILE_INFORMATION 12207
ReadX 12207 0 4096 4096
WriteX 12207 0 4096 4096
Flush 12207
WriteX 12197 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 12207 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12208
ReadX 12208 0 4096 4096
ReadX 12200 0 4096 4096
ReadX 12208 0 4096 4096
ReadX 12208 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12209
FIND_FIRST \clients\client1\~dmtmp\*
Close 12209
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12210
WriteX 12210 4095 1 1
QUERY_FILE_INFORMATION 12210
WriteX 12210 0 4096 4096
Close 12210
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12211
ReadX 12211 0 4096 4096
Close 12208
Close 12200
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12212
Close 12212
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12213
WriteX 12213 4095 1 1
QUERY_FILE_INFORMATION 12213
WriteX 12213 0 4096 4096
Close 12213
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12214
ReadX 12214 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 12214 0 4096 4096
Close 12211
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12190
Close 12184
Close 12187
Close 12188
Close 12189
Close 12185
Close 12179
Close 12182
Close 12183
Close 12180
Close 12181
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12214
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12216
Close 12216
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12217
ReadX 12217 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12218
Close 12218
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12219
WriteX 12219 2047 1 1
QUERY_FILE_INFORMATION 12219
WriteX 12219 0 2048 2048
Close 12219
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12220
ReadX 12220 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12220
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12221
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12221 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12222
ReadX 12222 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12223
ReadX 12223 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12224
ReadX 12224 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12225
ReadX 12225 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12226
ReadX 12226 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12227
ReadX 12227 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12228
ReadX 12228 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12229
ReadX 12229 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12230
ReadX 12230 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12231
ReadX 12231 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12232
ReadX 12232 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12233
ReadX 12233 0 4096 4096
ReadX 12221 0 4096 4096
ReadX 12228 0 4096 4096
Close 12228
Close 12221
Close 12197
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12234
QUERY_FILE_INFORMATION 12234
Close 12234
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12217
Close 12232
Close 12227
Close 12229
Close 12230
Close 12231
Close 12233
Close 12222
Close 12225
Close 12226
Close 12223
Close 12224
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12207
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12235
QUERY_FILE_INFORMATION 12235
Close 12235
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12236
FIND_FIRST \clients\client1\~dmtmp\*
Close 12236
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12237
ReadX 12237 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12238
ReadX 12238 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12239
ReadX 12239 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12240
ReadX 12240 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12241
ReadX 12241 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12242
ReadX 12242 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12243
ReadX 12243 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12244
ReadX 12244 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12245
ReadX 12245 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12246
ReadX 12246 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12247
ReadX 12247 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12248
ReadX 12248 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12249
ReadX 12249 0 4096 4096
ReadX 12237 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12253
FIND_FIRST \clients\client1\~dmtmp\*
Close 12253
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12254
QUERY_FILE_INFORMATION 12254
WriteX 12254 2047 1 1
QUERY_FILE_INFORMATION 12254
WriteX 12254 0 2048 2048
Close 12254
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12255
ReadX 12255 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12255
Close 12237
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12256
ReadX 12256 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12257
FIND_FIRST \clients\client1\~dmtmp\*
Close 12257
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12258
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12258 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12259
ReadX 12259 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12260
ReadX 12260 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12261
ReadX 12261 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12262
ReadX 12262 0 543 543
ReadX 12258 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12266
FIND_FIRST \clients\client1\~dmtmp\*
Close 12266
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12267
QUERY_FILE_INFORMATION 12267
WriteX 12267 2047 1 1
QUERY_FILE_INFORMATION 12267
WriteX 12267 0 2048 2048
Close 12267
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12268
ReadX 12268 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12268
Close 12258
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12269
ReadX 12269 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 12242
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12270
FIND_FIRST \clients\client1\~dmtmp\*
Close 12270
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12271
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12271 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12272
ReadX 12272 0 4096 4096
ReadX 12271 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12276
FIND_FIRST \clients\client1\~dmtmp\*
Close 12276
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12277
QUERY_FILE_INFORMATION 12277
WriteX 12277 2047 1 1
QUERY_FILE_INFORMATION 12277
WriteX 12277 0 2048 2048
Close 12277
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12278
ReadX 12278 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12278
Close 12272
Close 12271
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12279
ReadX 12279 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12256 4095 1 1
QUERY_FILE_INFORMATION 12256
ReadX 12256 0 4096 4096
WriteX 12256 0 4096 4096
Flush 12256
WriteX 12269 4095 1 1
QUERY_FILE_INFORMATION 12269
ReadX 12269 0 4096 4096
WriteX 12269 0 4096 4096
Flush 12269
WriteX 12279 4095 1 1
QUERY_FILE_INFORMATION 12279
ReadX 12279 0 4096 4096
WriteX 12279 0 4096 4096
Flush 12279
WriteX 12256 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 12269 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 12279 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12280
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12280 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12281
ReadX 12281 0 4096 4096
ReadX 12280 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12282
ReadX 12282 0 4096 4096
ReadX 12282 0 4096 4096
ReadX 12282 4096 16384 16384
ReadX 12280 4096 16384 16384
ReadX 12280 0 4096 4096
ReadX 12281 0 4096 4096
ReadX 12281 4096 4096 4096
Close 12282
Close 12281
Close 12280
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12283
FIND_FIRST \clients\client1\~dmtmp\*
Close 12283
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12284
ReadX 12284 0 2048 2048
WriteX 12284 18431 1 1
QUERY_FILE_INFORMATION 12284
WriteX 12284 0 19584 19584
Close 12284
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12285
ReadX 12285 0 4096 4096
ReadX 12285 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12285
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12286
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12286 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12287
ReadX 12287 0 4096 4096
ReadX 12286 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12288
ReadX 12288 0 4096 4096
ReadX 12288 0 4096 4096
Close 12288
Close 12287
Close 12286
Close 12256
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12289
QUERY_FILE_INFORMATION 12289
Close 12289
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12262
Close 12249
Close 12241
Close 12259
Close 12260
Close 12261
Close 12248
Close 12243
Close 12246
Close 12247
Close 12244
Close 12245
Close 12238
Close 12239
Close 12240
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12269
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12290
QUERY_FILE_INFORMATION 12290
Close 12290
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12279
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12291
QUERY_FILE_INFORMATION 12291
Close 12291
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12292
FIND_FIRST \clients\client1\~dmtmp\*
Close 12292
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12293
ReadX 12293 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12294
ReadX 12294 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12295
ReadX 12295 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12296
ReadX 12296 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12297
ReadX 12297 0 543 543
ReadX 12293 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12293 4096 16384 16384
WriteX 12293 0 4096 4096
Close 12293
WriteX 12294 0 4096 4096
WriteX 12295 0 4096 4096
WriteX 12296 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12298
FIND_FIRST \clients\client1\~dmtmp\*
Close 12298
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12299
ReadX 12299 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12300
ReadX 12300 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12301
ReadX 12301 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12302
ReadX 12302 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12303
ReadX 12303 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12304
ReadX 12304 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12305
ReadX 12305 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12306
ReadX 12306 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12307
ReadX 12307 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12308
ReadX 12308 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12309
ReadX 12309 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12310
ReadX 12310 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12311
ReadX 12311 0 4096 4096
ReadX 12299 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12312
ReadX 12312 0 8192 8192
ReadX 12299 4096 16384 16384
Close 12306
Close 12299
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12313
FIND_FIRST \clients\client1\~dmtmp\*
Close 12313
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12314
ReadX 12314 0 4096 4096
ReadX 12314 4096 4096 4096
ReadX 12314 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12315
ReadX 12315 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12316
ReadX 12316 0 4096 4096
ReadX 12315 0 4096 4096
ReadX 12315 0 4096 4096
ReadX 12315 4096 16384 16384
Close 12316
WriteX 12315 0 4096 4096
Close 12315
WriteX 12300 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12317
FIND_FIRST \clients\client1\~dmtmp\*
Close 12317
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12318
ReadX 12318 0 4096 4096
ReadX 12318 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12319
ReadX 12319 0 4096 4096
ReadX 12319 0 4096 4096
WriteX 12319 0 4096 4096
Close 12319
WriteX 12294 0 4096 4096
WriteX 12295 0 4096 4096
WriteX 12296 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12320
ReadX 12320 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12321
ReadX 12321 0 4096 4096
ReadX 12320 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12325
FIND_FIRST \clients\client1\~dmtmp\*
Close 12325
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12326
QUERY_FILE_INFORMATION 12326
WriteX 12326 2047 1 1
QUERY_FILE_INFORMATION 12326
WriteX 12326 0 2048 2048
Close 12326
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12327
ReadX 12327 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12327 4095 1 1
QUERY_FILE_INFORMATION 12327
ReadX 12327 0 4096 4096
WriteX 12327 0 4096 4096
Close 12327
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12328
ReadX 12328 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12328 0 4096 4096
Close 12321
Close 12320
WriteX 12328 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12329
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12329 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12330
ReadX 12330 0 4096 4096
ReadX 12329 0 4096 4096
ReadX 12329 4096 16384 16384
Close 12330
Close 12329
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12331
FIND_FIRST \clients\client1\~dmtmp\*
Close 12331
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12332
ReadX 12332 0 4096 4096
ReadX 12332 4096 4096 4096
WriteX 12332 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12332 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12332
ReadX 12328 0 4096 4096
WriteX 12328 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12333
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12333 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12334
ReadX 12334 0 4096 4096
ReadX 12333 0 4096 4096
ReadX 12333 4096 16384 16384
Close 12334
Close 12333
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12335
FIND_FIRST \clients\client1\~dmtmp\*
Close 12335
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12336
ReadX 12336 0 4096 4096
ReadX 12336 4096 4096 4096
WriteX 12336 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 12336 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12336
Close 12328
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12337
QUERY_FILE_INFORMATION 12337
Close 12337
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 12312
Close 12314
Close 12318
Close 12297
Close 12294
Close 12295
Close 12296
Close 12305
Close 12310
Close 12307
Close 12308
Close 12309
Close 12311
Close 12300
Close 12303
Close 12304
Close 12301
Close 12302
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12338
FIND_FIRST \clients\client1\~dmtmp\*
Close 12338
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12339
ReadX 12339 0 4096 4096
ReadX 12339 4096 4096 4096
ReadX 12339 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12340
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12340 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12341
ReadX 12341 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12342
ReadX 12342 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12343
ReadX 12343 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12344
ReadX 12344 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12345
ReadX 12345 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12346
ReadX 12346 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12347
ReadX 12347 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12348
ReadX 12348 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12349
ReadX 12349 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12350
ReadX 12350 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12351
ReadX 12351 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12352
ReadX 12352 0 4096 4096
ReadX 12340 0 4096 4096
ReadX 12340 0 4096 4096
ReadX 12340 4096 16384 16384
Close 12347
Close 12340
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12353
ReadX 12353 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12354
ReadX 12354 0 4096 4096
ReadX 12353 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12358
FIND_FIRST \clients\client1\~dmtmp\*
Close 12358
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12359
QUERY_FILE_INFORMATION 12359
WriteX 12359 2047 1 1
QUERY_FILE_INFORMATION 12359
WriteX 12359 0 2048 2048
Close 12359
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12360
ReadX 12360 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12360 4095 1 1
QUERY_FILE_INFORMATION 12360
ReadX 12360 0 4096 4096
WriteX 12360 0 4096 4096
Close 12360
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12361
ReadX 12361 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12361 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12365
Close 12365
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12366
QUERY_FILE_INFORMATION 12366
WriteX 12366 2047 1 1
QUERY_FILE_INFORMATION 12366
WriteX 12366 0 2048 2048
Close 12366
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12367
ReadX 12367 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12367 4095 1 1
QUERY_FILE_INFORMATION 12367
ReadX 12367 0 4096 4096
WriteX 12367 0 4096 4096
Close 12367
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12368
ReadX 12368 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12368 0 4096 4096
Close 12353
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12369
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12369 0 4096 4096
ReadX 12369 0 4096 4096
ReadX 12369 4096 16384 16384
Close 12369
Close 12361
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12370
QUERY_FILE_INFORMATION 12370
Close 12370
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12339
Close 12351
Close 12346
Close 12352
Close 12354
Close 12341
Close 12344
Close 12345
Close 12342
Close 12343
Close 12348
Close 12349
Close 12350
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12368
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12371
QUERY_FILE_INFORMATION 12371
Close 12371
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12372
ReadX 12372 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 12373
Close 12373
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 12374
WriteX 12374 63 1 1
QUERY_FILE_INFORMATION 12374
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12372 0 4096 4096
ReadX 12372 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12372 0 8192 8192
Flush 12372
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12372 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12372 0 8192 8192
Flush 12372
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12372 0 8192 8192
Flush 12372
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12372 0 8192 8192
Flush 12372
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12376
Close 12376
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12378
WriteX 12378 4065 1 1
QUERY_FILE_INFORMATION 12378
WriteX 12378 0 62591 62591
Close 12378
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12380
Close 12380
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12382
WriteX 12382 4094 1 1
QUERY_FILE_INFORMATION 12382
WriteX 12382 0 10845 10845
Close 12382
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12384
Close 12384
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12386
WriteX 12386 4081 1 1
QUERY_FILE_INFORMATION 12386
WriteX 12386 0 30118 30118
Close 12386
WriteX 12372 0 4096 4096
Close 12372
WriteX 12374 0 64 64
Close 12374
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12387
ReadX 12387 61440 4096 4096
ReadX 12387 126976 4096 4096
WriteX 12387 0 65471 65471
WriteX 12387 65471 65 65
WriteX 12387 65536 65471 65471
WriteX 12387 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12388
ReadX 12388 61440 4096 4096
ReadX 12388 126976 4096 4096
ReadX 12388 192512 4096 4096
ReadX 12388 258048 4096 4096
WriteX 12388 0 65471 65471
WriteX 12388 65471 65 65
WriteX 12388 65536 65471 65471
WriteX 12388 131007 65 65
WriteX 12388 131072 65471 65471
WriteX 12388 196543 65 65
WriteX 12388 196608 65471 65471
WriteX 12388 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12389
ReadX 12389 61440 4096 4096
ReadX 12389 126976 4096 4096
ReadX 12389 192512 4096 4096
ReadX 12389 258048 4096 4096
ReadX 12389 323584 4096 4096
ReadX 12389 389120 4096 4096
ReadX 12389 454656 4096 4096
ReadX 12389 520192 4096 4096
WriteX 12389 0 65471 65471
WriteX 12389 65471 65 65
WriteX 12389 65536 65471 65471
WriteX 12389 131007 65 65
WriteX 12389 131072 65471 65471
WriteX 12389 196543 65 65
WriteX 12389 196608 65471 65471
WriteX 12389 262079 65 65
WriteX 12389 262144 65471 65471
WriteX 12389 327615 65 65
WriteX 12389 327680 65471 65471
WriteX 12389 393151 65 65
WriteX 12389 393216 65471 65471
WriteX 12389 458687 65 65
WriteX 12389 458752 65471 65471
WriteX 12389 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12390
Close 12390
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12387
Close 12388
Close 12389
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12391
ReadX 12391 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12392
ReadX 12392 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 12393
ReadX 12393 0 4096 4096
ReadX 12393 4096 4096 4096
ReadX 12393 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12394
Close 12394
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12391
Close 12392
Close 12393
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12395
Close 12395
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12396
ReadX 12396 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12397
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 12397
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12398
Close 12398
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12399
ReadX 12399 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12400
Close 12400
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12396
Close 12399
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12401
Close 12401
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12402
ReadX 12402 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12403
ReadX 12403 0 8192 8192
ReadX 12403 8192 8192 8192
ReadX 12403 16384 8192 8192
ReadX 12403 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12405
Close 12405
Close 12402
Close 12403
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12407
WriteX 12407 8191 1 1
QUERY_FILE_INFORMATION 12407
WriteX 12407 0 10438 10438
Close 12407
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12408
Close 12408
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12409
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12410
Close 12410
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12411
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12412
Close 12412
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12413
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12414
FIND_FIRST \clients\client1\~dmtmp\*
Close 12414
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12415
Close 12415
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12416
ReadX 12416 0 4096 4096
Close 12416
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12417
ReadX 12417 0 8192 8192
Close 12417
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12418
ReadX 12418 0 8192 8192
ReadX 12418 8192 4096 4096
ReadX 12418 12288 8192 8192
ReadX 12418 20480 8192 8192
ReadX 12418 28672 8192 8192
ReadX 12418 36864 8192 8192
ReadX 12418 45056 8192 8192
ReadX 12418 53248 8192 8192
ReadX 12418 61440 8192 8192
ReadX 12418 69632 8192 8192
ReadX 12418 77824 8192 8192
ReadX 12418 86016 8192 8192
ReadX 12418 94208 8192 8192
ReadX 12418 102400 8192 8192
ReadX 12418 110592 8192 8192
ReadX 12418 118784 8192 8192
ReadX 12418 126976 8192 8192
ReadX 12418 135168 8192 8192
ReadX 12418 143360 8192 8192
ReadX 12418 151552 8192 8192
ReadX 12418 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 12419
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12419
Close 12418
Close 12409
Close 12411
Close 12413
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 12420
Close 12420
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12422
WriteX 12422 8191 1 1
QUERY_FILE_INFORMATION 12422
WriteX 12422 0 28489 28489
Close 12422
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12423
Close 12423
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12424
FIND_FIRST \clients\client1\~dmtmp\*
Close 12424
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12425
Close 12425
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12426
ReadX 12426 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12427
Close 12427
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12426
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12428
Close 12428
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12429
ReadX 12429 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12430
ReadX 12430 0 8192 8192
ReadX 12430 8192 8192 8192
ReadX 12430 16384 8192 8192
ReadX 12430 24576 8192 8192
ReadX 12430 32768 16384 16384
ReadX 12430 49152 8192 8192
ReadX 12430 57344 8192 8192
ReadX 12430 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12432
Close 12432
Close 12429
Close 12430
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12434
WriteX 12434 8191 1 1
QUERY_FILE_INFORMATION 12434
WriteX 12434 0 29253 29253
Close 12434
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12435
Close 12435
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12436
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 12437
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 12437
Close 12436
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 12438
Close 12438
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12440
WriteX 12440 8191 1 1
QUERY_FILE_INFORMATION 12440
WriteX 12440 0 30183 30183
Close 12440
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12441
Close 12441
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12442
WriteX 12442 0 510 510
WriteX 12442 510 512 512
WriteX 12442 1022 510 510
WriteX 12442 1532 510 510
WriteX 12442 2042 168 168
Close 12442
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12443
Close 12443
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12444
ReadX 12444 0 4096 4096
WriteX 12444 0 4096 4096
Close 12444
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12445
ReadX 12445 0 65471 65471
ReadX 12445 65471 65 65
ReadX 12445 65536 65471 65471
ReadX 12445 131007 65 65
ReadX 12445 131072 65471 65471
ReadX 12445 196543 65 65
ReadX 12445 196608 65471 65471
ReadX 12445 262079 65 65
ReadX 12445 262144 65471 65471
ReadX 12445 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12446
ReadX 12446 0 65471 65471
ReadX 12446 65471 65 65
ReadX 12446 65536 65471 65471
ReadX 12446 131007 65 65
ReadX 12446 131072 65471 65471
ReadX 12446 196543 65 65
ReadX 12446 196608 65471 65471
ReadX 12446 262079 65 65
ReadX 12446 262144 65471 65471
ReadX 12446 327615 65 65
ReadX 12446 327680 65471 65471
ReadX 12446 393151 65 65
ReadX 12446 393216 65471 65471
ReadX 12446 458687 65 65
ReadX 12446 458752 65471 65471
ReadX 12446 524223 65 65
ReadX 12446 524288 65471 65471
ReadX 12446 589759 65 65
ReadX 12446 589824 65471 65471
ReadX 12446 655295 65 65
ReadX 12446 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12447
ReadX 12447 0 65471 65471
ReadX 12447 65471 65 65
ReadX 12447 65536 65471 65471
ReadX 12447 131007 65 65
ReadX 12447 131072 65471 65471
ReadX 12447 196543 65 65
ReadX 12447 196608 65471 65471
ReadX 12447 262079 65 65
ReadX 12447 262144 65471 65471
ReadX 12447 327615 65 65
ReadX 12447 327680 65471 65471
ReadX 12447 393151 65 65
ReadX 12447 393216 65471 65471
ReadX 12447 458687 65 65
ReadX 12447 458752 65471 65471
ReadX 12447 524223 65 65
ReadX 12447 524288 65471 65471
ReadX 12447 589759 65 65
ReadX 12447 589824 65471 65471
ReadX 12447 655295 65 65
ReadX 12447 655360 65471 65471
ReadX 12447 720831 65 65
ReadX 12447 720896 65471 65471
ReadX 12447 786367 65 65
ReadX 12447 786432 65471 65471
ReadX 12447 851903 65 65
ReadX 12447 851968 65471 65471
ReadX 12447 917439 65 65
ReadX 12447 917504 65471 65471
ReadX 12447 982975 65 65
ReadX 12447 983040 65471 65471
ReadX 12447 1048511 65 65
ReadX 12447 1048576 65471 65471
ReadX 12447 1114047 65 65
ReadX 12447 1114112 65471 65471
ReadX 12447 1179583 65 65
ReadX 12447 1179648 65471 65471
ReadX 12447 1245119 65 65
ReadX 12447 1245184 65471 65471
ReadX 12447 1310655 65 65
ReadX 12447 1310720 65471 65471
ReadX 12447 1376191 65 65
ReadX 12447 1376256 65471 65471
ReadX 12447 1441727 65 65
ReadX 12447 1441792 65471 65471
ReadX 12447 1507263 65 65
ReadX 12447 1507328 65471 65471
ReadX 12447 1572799 65 65
ReadX 12447 1572864 65471 65471
ReadX 12447 1638335 65 65
ReadX 12447 1638400 65471 65471
ReadX 12447 1703871 65 65
ReadX 12447 1703936 65471 65471
ReadX 12447 1769407 65 65
ReadX 12447 1769472 65471 65471
ReadX 12447 1834943 65 65
ReadX 12447 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12448
ReadX 12448 0 4096 4096
ReadX 12448 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 12449
WriteX 12449 52 1 1
QUERY_FILE_INFORMATION 12449
WriteX 12449 0 53 53
Close 12449
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12450
Close 12450
Close 12445
Close 12446
Close 12447
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12448 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12451
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12448 0 4096 4096
ReadX 12448 4096 4096 4096
ReadX 12448 8192 4096 4096
ReadX 12448 12288 4096 4096
WriteX 12451 15359 1 1
QUERY_FILE_INFORMATION 12451
ReadX 12448 16384 4096 4096
ReadX 12448 20480 4096 4096
WriteX 12451 0 15360 15360
Close 12451
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 12452
ReadX 12452 0 4096 4096
WriteX 12452 0 4096 4096
Close 12452
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 12453
Close 12453
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12454
ReadX 12454 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 12455
Close 12455
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 12448
ReadX 12454 0 4096 4096
ReadX 12454 4096 4096 4096
ReadX 12454 8192 4096 4096
ReadX 12454 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12456
ReadX 12456 0 4096 4096
ReadX 12456 0 4096 4096
ReadX 12456 4096 4096 4096
ReadX 12456 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12457
ReadX 12457 0 4096 4096
ReadX 12457 4096 4096 4096
ReadX 12457 8192 4096 4096
Close 12456
Close 12457
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12458
WriteX 12458 15359 1 1
QUERY_FILE_INFORMATION 12458
WriteX 12458 0 15360 15360
Close 12458
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 12459
ReadX 12459 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 12454
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12460
Close 12460
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12461
ReadX 12461 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 12462
Close 12462
WriteX 12459 0 4096 4096
Close 12459
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 12463
Close 12463
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12464
ReadX 12464 0 4096 4096
ReadX 12464 0 4096 4096
ReadX 12464 4096 4096 4096
ReadX 12464 8192 4096 4096
ReadX 12464 12288 3072 3072
ReadX 12464 0 8192 8192
ReadX 12464 8192 4096 4096
ReadX 12464 12288 3072 3072
WriteX 12464 15469 1 1
QUERY_FILE_INFORMATION 12464
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12465
ReadX 12465 0 4096 4096
ReadX 12465 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 12466
WriteX 12466 52 1 1
QUERY_FILE_INFORMATION 12466
WriteX 12466 0 53 53
Close 12466
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12467
Close 12467
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12468
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12465 0 8192 8192
ReadX 12465 8192 4096 4096
ReadX 12465 12288 4096 4096
WriteX 12468 12005 1 1
QUERY_FILE_INFORMATION 12468
WriteX 12468 0 12006 12006
Close 12468
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 12469
ReadX 12469 0 4096 4096
WriteX 12469 0 4096 4096
Close 12469
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 12470
Close 12470
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12471
ReadX 12471 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 12472
Close 12472
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 12465
ReadX 12471 0 4096 4096
ReadX 12471 4096 4096 4096
ReadX 12471 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12473
WriteX 12473 11990 1 1
QUERY_FILE_INFORMATION 12473
WriteX 12473 0 11991 11991
Close 12473
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 12474
ReadX 12474 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 12471
WriteX 12464 0 19054 19054
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12475
Close 12475
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12476
ReadX 12476 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 12477
Close 12477
WriteX 12474 0 4096 4096
Close 12474
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 12478
Close 12478
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12479
ReadX 12479 0 4096 4096
ReadX 12479 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12480
Close 12480
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 12479 0 8192 8192
ReadX 12479 8192 3799 3799
WriteX 12479 13247 1 1
QUERY_FILE_INFORMATION 12479
WriteX 12479 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12479 0 8192 8192
ReadX 12479 8192 4096 4096
Close 12461
Close 12464
WriteX 12479 0 12288 12288
Close 12479
Close 12476
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12481
Close 12481
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12482
Close 12482
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12483
ReadX 12483 61440 4096 4096
ReadX 12483 126976 4096 4096
WriteX 12483 0 65471 65471
WriteX 12483 65471 65 65
WriteX 12483 65536 65471 65471
WriteX 12483 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12484
ReadX 12484 61440 4096 4096
ReadX 12484 126976 4096 4096
ReadX 12484 192512 4096 4096
ReadX 12484 258048 4096 4096
WriteX 12484 0 65471 65471
WriteX 12484 65471 65 65
WriteX 12484 65536 65471 65471
WriteX 12484 131007 65 65
WriteX 12484 131072 65471 65471
WriteX 12484 196543 65 65
WriteX 12484 196608 65471 65471
WriteX 12484 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12485
ReadX 12485 61440 4096 4096
ReadX 12485 126976 4096 4096
ReadX 12485 192512 4096 4096
ReadX 12485 258048 4096 4096
ReadX 12485 323584 4096 4096
ReadX 12485 389120 4096 4096
ReadX 12485 454656 4096 4096
ReadX 12485 520192 4096 4096
WriteX 12485 0 65471 65471
WriteX 12485 65471 65 65
WriteX 12485 65536 65471 65471
WriteX 12485 131007 65 65
WriteX 12485 131072 65471 65471
WriteX 12485 196543 65 65
WriteX 12485 196608 65471 65471
WriteX 12485 262079 65 65
WriteX 12485 262144 65471 65471
WriteX 12485 327615 65 65
WriteX 12485 327680 65471 65471
WriteX 12485 393151 65 65
WriteX 12485 393216 65471 65471
WriteX 12485 458687 65 65
WriteX 12485 458752 65471 65471
WriteX 12485 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12486
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12486 0 4096 4096
Close 12486
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12487
ReadX 12487 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12487
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12488
ReadX 12488 0 4096 4096
ReadX 12488 4096 4096 4096
ReadX 12488 8192 4096 4096
ReadX 12488 12288 4096 4096
ReadX 12488 16384 4096 4096
ReadX 12488 20480 4096 4096
ReadX 12488 24576 4096 4096
ReadX 12488 28672 4096 4096
ReadX 12488 32768 4096 4096
ReadX 12488 36864 4096 4096
ReadX 12488 40960 4096 4096
ReadX 12488 45056 4096 4096
ReadX 12488 49152 4096 4096
ReadX 12488 53248 4096 4096
ReadX 12488 57344 4096 4096
ReadX 12488 61440 4096 4096
ReadX 12488 65536 4096 4096
ReadX 12488 69632 4096 4096
ReadX 12488 73728 4096 4096
WriteX 12488 0 4096 4096
Close 12488
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12489
Close 12489
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12490
ReadX 12490 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12491
Close 12491
Close 12483
Close 12484
Close 12485
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12490
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12493
WriteX 12493 4607 1 1
QUERY_FILE_INFORMATION 12493
WriteX 12493 0 65471 65471
WriteX 12493 65471 65 65
WriteX 12493 65536 19979 19979
Close 12493
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12494
ReadX 12494 0 4096 4096
WriteX 12494 0 4096 4096
Flush 12494
WriteX 12494 0 4096 4096
Flush 12494
QUERY_FILE_INFORMATION 12494
WriteX 12494 0 4096 4096
Flush 12494
WriteX 12494 0 4096 4096
Flush 12494
WriteX 12494 0 4096 4096
Flush 12494
WriteX 12494 0 4096 4096
Flush 12494
Close 12494
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12495
ReadX 12495 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 12496
ReadX 12496 0 4096 4096
Close 12495
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12497
ReadX 12497 0 4096 4096
Close 12497
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12498
ReadX 12498 0 4096 4096
Close 12498
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12499
ReadX 12499 0 4096 4096
WriteX 12499 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 12500
Close 12500
Close 12496
Close 12499
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12501
Close 12501
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12503
WriteX 12503 4607 1 1
QUERY_FILE_INFORMATION 12503
WriteX 12503 0 65471 65471
WriteX 12503 65471 65 65
WriteX 12503 65536 17654 17654
Close 12503
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12504
ReadX 12504 0 4096 4096
WriteX 12504 0 4096 4096
Flush 12504
WriteX 12504 0 4096 4096
Flush 12504
QUERY_FILE_INFORMATION 12504
WriteX 12504 0 4096 4096
Flush 12504
WriteX 12504 0 4096 4096
Flush 12504
WriteX 12504 0 4096 4096
Flush 12504
WriteX 12504 0 4096 4096
Flush 12504
Close 12504
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12505
Close 12505
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12506
ReadX 12506 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 12507
Close 12507
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 12508
ReadX 12508 0 4096 4096
ReadX 12508 4096 4096 4096
ReadX 12508 8192 4096 4096
ReadX 12508 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12508 16384 4096 4096
ReadX 12508 20480 4096 4096
ReadX 12508 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 12506
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12509
ReadX 12509 0 4096 4096
Close 12509
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12510
ReadX 12510 0 4096 4096
Close 12510
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12511
ReadX 12511 0 4096 4096
WriteX 12511 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 12512
Close 12512
Close 12511
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12513
Close 12513
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12515
WriteX 12515 4607 1 1
QUERY_FILE_INFORMATION 12515
WriteX 12515 0 65471 65471
WriteX 12515 65471 65 65
WriteX 12515 65536 19490 19490
Close 12515
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12516
ReadX 12516 0 4096 4096
WriteX 12516 0 4096 4096
Flush 12516
WriteX 12516 0 4096 4096
Flush 12516
QUERY_FILE_INFORMATION 12516
WriteX 12516 0 4096 4096
Flush 12516
WriteX 12516 0 4096 4096
Flush 12516
WriteX 12516 0 4096 4096
Flush 12516
WriteX 12516 0 4096 4096
Flush 12516
Close 12516
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12517
Close 12517
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12518
ReadX 12518 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 12519
Close 12519
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12518
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12520
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12520 0 4096 4096
Close 12520
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12521
ReadX 12521 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12521
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12522
ReadX 12522 0 4096 4096
ReadX 12522 4096 4096 4096
ReadX 12522 8192 4096 4096
ReadX 12522 12288 4096 4096
ReadX 12522 16384 4096 4096
ReadX 12522 20480 4096 4096
ReadX 12522 24576 4096 4096
ReadX 12522 28672 4096 4096
ReadX 12522 32768 4096 4096
ReadX 12522 36864 4096 4096
ReadX 12522 40960 4096 4096
ReadX 12522 45056 4096 4096
ReadX 12522 49152 4096 4096
ReadX 12522 53248 4096 4096
ReadX 12522 57344 4096 4096
ReadX 12522 61440 4096 4096
ReadX 12522 65536 4096 4096
ReadX 12522 69632 4096 4096
ReadX 12522 73728 4096 4096
WriteX 12522 0 4096 4096
Close 12522
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12523
Close 12523
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12524
ReadX 12524 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12525
Close 12525
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12524
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12527
WriteX 12527 4607 1 1
QUERY_FILE_INFORMATION 12527
WriteX 12527 0 65471 65471
WriteX 12527 65471 65 65
WriteX 12527 65536 8866 8866
Close 12527
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12528
ReadX 12528 0 4096 4096
WriteX 12528 0 4096 4096
Flush 12528
WriteX 12528 0 4096 4096
Flush 12528
Close 12528
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12529
ReadX 12529 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12529
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12530
ReadX 12530 0 4096 4096
Close 12530
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12531
ReadX 12531 0 4096 4096
Close 12531
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12532
ReadX 12532 0 4096 4096
WriteX 12532 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 12533
Close 12533
Close 12532
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12534
Close 12534
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12536
WriteX 12536 4607 1 1
QUERY_FILE_INFORMATION 12536
WriteX 12536 0 65471 65471
WriteX 12536 65471 65 65
WriteX 12536 65536 9298 9298
Close 12536
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12537
ReadX 12537 0 4096 4096
WriteX 12537 0 4096 4096
Flush 12537
WriteX 12537 0 4096 4096
Flush 12537
Close 12537
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12538
Close 12538
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12539
ReadX 12539 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 12540
Close 12540
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12542
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12542 0 4096 4096
Close 12542
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12543
ReadX 12543 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12543 4096 4096 4096
ReadX 12543 8192 4096 4096
ReadX 12543 12288 4096 4096
ReadX 12543 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 12539
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12544
ReadX 12544 0 4096 4096
Close 12544
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12545
ReadX 12545 0 4096 4096
Close 12545
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12546
ReadX 12546 0 4096 4096
WriteX 12546 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 12547
Close 12547
Close 12543
Close 12546
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12548
Close 12548
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12550
WriteX 12550 4607 1 1
QUERY_FILE_INFORMATION 12550
WriteX 12550 0 65471 65471
WriteX 12550 65471 65 65
WriteX 12550 65536 11540 11540
Close 12550
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12551
ReadX 12551 0 4096 4096
WriteX 12551 0 4096 4096
Flush 12551
WriteX 12551 0 4096 4096
Flush 12551
Close 12551
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12552
Close 12552
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12553
ReadX 12553 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 12554
Close 12554
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12553
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12555
ReadX 12555 0 65471 65471
ReadX 12555 65471 65 65
ReadX 12555 65536 65471 65471
ReadX 12555 131007 65 65
ReadX 12555 131072 65471 65471
ReadX 12555 196543 65 65
ReadX 12555 196608 65471 65471
ReadX 12555 262079 65 65
ReadX 12555 262144 65471 65471
ReadX 12555 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12556
ReadX 12556 0 65471 65471
ReadX 12556 65471 65 65
ReadX 12556 65536 65471 65471
ReadX 12556 131007 65 65
ReadX 12556 131072 65471 65471
ReadX 12556 196543 65 65
ReadX 12556 196608 65471 65471
ReadX 12556 262079 65 65
ReadX 12556 262144 65471 65471
ReadX 12556 327615 65 65
ReadX 12556 327680 65471 65471
ReadX 12556 393151 65 65
ReadX 12556 393216 65471 65471
ReadX 12556 458687 65 65
ReadX 12556 458752 65471 65471
ReadX 12556 524223 65 65
ReadX 12556 524288 65471 65471
ReadX 12556 589759 65 65
ReadX 12556 589824 65471 65471
ReadX 12556 655295 65 65
ReadX 12556 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12557
ReadX 12557 0 65471 65471
ReadX 12557 65471 65 65
ReadX 12557 65536 65471 65471
ReadX 12557 131007 65 65
ReadX 12557 131072 65471 65471
ReadX 12557 196543 65 65
ReadX 12557 196608 65471 65471
ReadX 12557 262079 65 65
ReadX 12557 262144 65471 65471
ReadX 12557 327615 65 65
ReadX 12557 327680 65471 65471
ReadX 12557 393151 65 65
ReadX 12557 393216 65471 65471
ReadX 12557 458687 65 65
ReadX 12557 458752 65471 65471
ReadX 12557 524223 65 65
ReadX 12557 524288 65471 65471
ReadX 12557 589759 65 65
ReadX 12557 589824 65471 65471
ReadX 12557 655295 65 65
ReadX 12557 655360 65471 65471
ReadX 12557 720831 65 65
ReadX 12557 720896 65471 65471
ReadX 12557 786367 65 65
ReadX 12557 786432 65471 65471
ReadX 12557 851903 65 65
ReadX 12557 851968 65471 65471
ReadX 12557 917439 65 65
ReadX 12557 917504 65471 65471
Close 12508
ReadX 12557 982975 65 65
ReadX 12557 983040 65471 65471
Close 12555
ReadX 12557 1048511 65 65
ReadX 12557 1048576 65471 65471
Close 12556
ReadX 12557 1114047 65 65
ReadX 12557 1114112 65471 65471
ReadX 12557 1179583 65 65
ReadX 12557 1179648 65471 65471
ReadX 12557 1245119 65 65
ReadX 12557 1245184 65471 65471
ReadX 12557 1310655 65 65
ReadX 12557 1310720 65471 65471
ReadX 12557 1376191 65 65
ReadX 12557 1376256 65471 65471
ReadX 12557 1441727 65 65
ReadX 12557 1441792 65471 65471
ReadX 12557 1507263 65 65
ReadX 12557 1507328 65471 65471
ReadX 12557 1572799 65 65
ReadX 12557 1572864 65471 65471
ReadX 12557 1638335 65 65
ReadX 12557 1638400 65471 65471
ReadX 12557 1703871 65 65
ReadX 12557 1703936 65471 65471
ReadX 12557 1769407 65 65
ReadX 12557 1769472 65471 65471
ReadX 12557 1834943 65 65
ReadX 12557 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12558
FIND_FIRST \clients\client1\~dmtmp\*
Close 12558
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12559
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12560
QUERY_FILE_INFORMATION 12560
QUERY_FILE_INFORMATION 12560
QUERY_FILE_INFORMATION 12560
ReadX 12560 2156 24 24
ReadX 12560 2139 276 276
ReadX 12560 2136 14 14
ReadX 12560 2136 7 7
ReadX 12560 2138 12 12
ReadX 12560 2137 8 8
ReadX 12560 2135 15 15
ReadX 12560 0 16 16
ReadX 12560 16 2048 2048
ReadX 12560 2064 2048 2048
ReadX 12560 257 2048 2048
ReadX 12560 385 2048 2048
ReadX 12560 513 2048 2048
ReadX 12560 641 2048 2048
ReadX 12560 769 2048 2048
ReadX 12560 897 2048 2048
ReadX 12560 1025 2048 2048
ReadX 12560 1153 2048 2048
ReadX 12560 1281 2048 2048
ReadX 12560 1409 2048 2048
ReadX 12560 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12562
Close 12562
Close 12557
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12564
WriteX 12564 15 1 1
QUERY_FILE_INFORMATION 12564
WriteX 12564 0 10575 10575
Flush 12564
Close 12564
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12565
Close 12565
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12566
ReadX 12566 0 4096 4096
Close 12560
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12567
Close 12567
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12568
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12569
QUERY_FILE_INFORMATION 12569
ReadX 12569 0 512 512
ReadX 12569 512 512 512
ReadX 12569 1024 512 512
QUERY_FILE_INFORMATION 12569
QUERY_FILE_INFORMATION 12569
Close 12569
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12570
QUERY_FILE_INFORMATION 12570
ReadX 12570 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12571
QUERY_FILE_INFORMATION 12571
ReadX 12571 0 512 512
ReadX 12571 512 512 512
ReadX 12571 1024 512 512
ReadX 12571 288 20 20
ReadX 12571 308 2084 2084
ReadX 12571 388 2084 2084
ReadX 12571 388 2084 2084
ReadX 12559 2157 1386 1386
ReadX 12571 2472 399 399
ReadX 12571 3072 1536 1536
ReadX 12571 544 149 149
ReadX 12571 693 485 485
Close 12571
ReadX 12559 2157 4096 4096
ReadX 12559 6253 4096 4096
ReadX 12559 10349 4096 4096
ReadX 12559 14445 4096 4096
ReadX 12559 18541 4096 4096
ReadX 12559 22637 256 256
ReadX 12559 22893 4096 4096
ReadX 12559 26989 4096 4096
ReadX 12559 31085 4096 4096
ReadX 12559 35181 4096 4096
ReadX 12559 39277 4096 4096
ReadX 12559 43373 4096 4096
ReadX 12559 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12559 2157 1024 1024
ReadX 12559 1667 4688 4688
ReadX 12559 6355 3516 3516
ReadX 12559 9871 16384 16384
ReadX 12559 26255 3771 3771
ReadX 12559 30026 2048 2048
ReadX 12559 32074 1024 1024
ReadX 12559 33098 6652 6652
ReadX 12559 39750 16384 16384
ReadX 12559 56134 10496 10496
ReadX 12559 66630 1784 1784
ReadX 12559 68414 90 90
ReadX 12559 68504 273 273
ReadX 12559 68777 1600 1600
ReadX 12559 70377 640 640
ReadX 12559 71017 1280 1280
ReadX 12559 72297 8464 8464
ReadX 12559 80761 158 158
ReadX 12559 80919 912 912
ReadX 12559 81831 1980 1980
ReadX 12559 83811 2256 2256
ReadX 12559 86067 400 400
ReadX 12559 86467 252 252
ReadX 12559 86719 42 42
ReadX 12559 86761 725 725
ReadX 12559 2009 512 512
ReadX 12559 3895 9 9
ReadX 12559 3781 46 46
ReadX 12559 4059 92 92
ReadX 12559 3781 92 92
ReadX 12559 3986 184 184
ReadX 12559 3987 16384 16384
ReadX 12559 3902 16384 16384
ReadX 12559 3781 10240 10240
ReadX 12559 3821 16384 16384
ReadX 12559 3891 935 935
ReadX 12559 4060 10240 10240
ReadX 12559 4059 184 184
ReadX 12559 256 184 184
ReadX 12559 256 1026 1026
ReadX 12559 3901 326 326
ReadX 12559 3899 652 652
ReadX 12559 256 2 2
ReadX 12559 258 4948 4948
Close 12559
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12573
Close 12573
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12575
WriteX 12575 4055 1 1
QUERY_FILE_INFORMATION 12575
WriteX 12575 0 65471 65471
WriteX 12575 65471 65 65
WriteX 12575 65536 65471 65471
WriteX 12575 131007 65 65
WriteX 12575 131072 65471 65471
WriteX 12575 196543 65 65
WriteX 12575 196608 65471 65471
WriteX 12575 262079 65 65
WriteX 12575 262144 65471 65471
WriteX 12575 327615 65 65
WriteX 12575 327680 65471 65471
WriteX 12575 393151 65 65
WriteX 12575 393216 65471 65471
WriteX 12575 458687 65 65
WriteX 12575 458752 65471 65471
WriteX 12575 524223 65 65
WriteX 12575 524288 65471 65471
WriteX 12575 589759 65 65
WriteX 12575 589824 35257 35257
Close 12575
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12577
Close 12577
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12579
WriteX 12579 4055 1 1
QUERY_FILE_INFORMATION 12579
WriteX 12579 0 65471 65471
WriteX 12579 65471 65 65
WriteX 12579 65536 65471 65471
WriteX 12579 131007 65 65
WriteX 12579 131072 65471 65471
WriteX 12579 196543 65 65
WriteX 12579 196608 65471 65471
WriteX 12579 262079 65 65
WriteX 12579 262144 65471 65471
WriteX 12579 327615 65 65
WriteX 12579 327680 65471 65471
WriteX 12579 393151 65 65
WriteX 12579 393216 65471 65471
WriteX 12579 458687 65 65
WriteX 12579 458752 65471 65471
WriteX 12579 524223 65 65
WriteX 12579 524288 65471 65471
WriteX 12579 589759 65 65
WriteX 12579 589824 57598 57598
Close 12579
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12581
WriteX 12581 15 1 1
QUERY_FILE_INFORMATION 12581
WriteX 12581 0 12543 12543
Flush 12581
Close 12581
Close 12566
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12582
Close 12582
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12583
ReadX 12583 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12584
FIND_FIRST \clients\client1\~dmtmp\*
Close 12584
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12585
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12586
QUERY_FILE_INFORMATION 12586
QUERY_FILE_INFORMATION 12586
QUERY_FILE_INFORMATION 12586
ReadX 12586 1938 24 24
ReadX 12586 1920 276 276
ReadX 12586 1918 14 14
ReadX 12586 1918 7 7
ReadX 12586 1919 12 12
ReadX 12586 1919 8 8
ReadX 12586 1917 15 15
ReadX 12586 0 16 16
ReadX 12586 16 2048 2048
ReadX 12586 2064 2048 2048
ReadX 12586 257 2048 2048
ReadX 12586 385 2048 2048
ReadX 12586 513 2048 2048
ReadX 12586 641 2048 2048
ReadX 12586 769 2048 2048
ReadX 12586 897 2048 2048
ReadX 12586 1025 2048 2048
ReadX 12586 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12588
Close 12588
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12590
WriteX 12590 15 1 1
QUERY_FILE_INFORMATION 12590
WriteX 12590 0 11588 11588
Flush 12590
Close 12590
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12591
Close 12591
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12592
ReadX 12592 0 4096 4096
Close 12586
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12594
WriteX 12594 15 1 1
QUERY_FILE_INFORMATION 12594
WriteX 12594 0 11615 11615
Flush 12594
Close 12594
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12592
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12595
Close 12595
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12596
ReadX 12596 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12598
Close 12598
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12600
WriteX 12600 4088 1 1
QUERY_FILE_INFORMATION 12600
WriteX 12600 0 65471 65471
WriteX 12600 65471 65 65
WriteX 12600 65536 16050 16050
Close 12600
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12585 1939 64 64
ReadX 12585 128 248 248
ReadX 12585 128 568 568
ReadX 12585 3872 1536 1536
ReadX 12585 3456 2560 2560
ReadX 12585 3136 512 512
ReadX 12585 2880 4096 4096
ReadX 12585 3264 3072 3072
ReadX 12585 320 4096 4096
ReadX 12585 1024 4096 4096
ReadX 12585 3616 4096 4096
ReadX 12585 1939 64 64
ReadX 12585 128 248 248
ReadX 12585 128 608 608
ReadX 12585 2858 1024 1024
ReadX 12585 2810 4096 4096
ReadX 12585 2826 4096 4096
ReadX 12585 2580 2048 2048
ReadX 12585 2800 2560 2560
ReadX 12585 2100 4096 4096
ReadX 12585 2084 4096 4096
ReadX 12585 868 4096 4096
ReadX 12585 2324 4096 4096
ReadX 12585 884 4096 4096
ReadX 12585 2604 1024 1024
ReadX 12585 580 4096 4096
ReadX 12585 596 4096 4096
ReadX 12585 2752 4096 4096
ReadX 12585 2842 1024 1024
ReadX 12585 660 4096 4096
ReadX 12585 2720 4096 4096
ReadX 12585 2736 4096 4096
ReadX 12585 628 4096 4096
ReadX 12585 2704 4096 4096
ReadX 12585 1556 4096 4096
ReadX 12585 576 4096 4096
ReadX 12585 3168 1536 1536
ReadX 12585 832 4096 4096
ReadX 12585 1088 4096 4096
ReadX 12585 1344 4096 4096
ReadX 12585 1600 4096 4096
ReadX 12585 1856 4096 4096
ReadX 12585 2112 4096 4096
ReadX 12585 1892 4096 4096
ReadX 12585 820 4096 4096
ReadX 12585 788 4096 4096
ReadX 12585 1604 4096 4096
ReadX 12585 3648 4096 4096
ReadX 12585 2608 4096 4096
ReadX 12585 548 4096 4096
ReadX 12585 740 4096 4096
ReadX 12585 1344 4096 4096
ReadX 12585 3392 4096 4096
ReadX 12585 3904 4096 4096
ReadX 12585 644 4096 4096
ReadX 12585 676 4096 4096
ReadX 12585 2688 4096 4096
ReadX 12585 320 4096 4096
ReadX 12585 900 4096 4096
ReadX 12585 1908 4096 4096
ReadX 12585 852 4096 4096
ReadX 12585 724 4096 4096
ReadX 12585 2292 4096 4096
ReadX 12585 612 4096 4096
ReadX 12585 388 4096 4096
ReadX 12585 2368 4096 4096
ReadX 12585 2624 4096 4096
ReadX 12585 500 4096 4096
ReadX 12585 356 4096 4096
ReadX 12585 1024 4096 4096
ReadX 12585 576 4096 4096
ReadX 12585 340 4096 4096
ReadX 12585 420 4096 4096
ReadX 12585 1600 4096 4096
ReadX 12585 404 4096 4096
ReadX 12585 1428 4096 4096
ReadX 12585 2656 4096 4096
ReadX 12585 2624 4096 4096
ReadX 12585 452 4096 4096
ReadX 12585 692 4096 4096
ReadX 12585 564 4096 4096
ReadX 12585 372 4096 4096
ReadX 12585 468 4096 4096
ReadX 12585 484 4096 4096
ReadX 12585 1088 4096 4096
ReadX 12585 1924 4096 4096
ReadX 12585 2768 4096 4096
ReadX 12585 832 4096 4096
ReadX 12585 836 4096 4096
ReadX 12585 1856 4096 4096
ReadX 12585 2640 4096 4096
ReadX 12585 436 4096 4096
ReadX 12585 1828 4096 4096
ReadX 12585 804 4096 4096
ReadX 12585 1860 4096 4096
ReadX 12585 1812 4096 4096
ReadX 12585 756 4096 4096
ReadX 12585 1636 4096 4096
ReadX 12585 772 4096 4096
ReadX 12585 2036 4096 4096
ReadX 12585 1220 4096 4096
ReadX 12585 1652 4096 4096
ReadX 12585 2588 4096 4096
ReadX 12585 916 4096 4096
ReadX 12585 260 4096 4096
ReadX 12585 932 4096 4096
ReadX 12585 2624 4096 4096
ReadX 12585 308 4096 4096
ReadX 12585 292 4096 4096
ReadX 12585 1140 4096 4096
ReadX 12585 276 4096 4096
ReadX 12585 2020 4096 4096
ReadX 12585 2880 4096 4096
ReadX 12585 516 4096 4096
ReadX 12585 1844 4096 4096
ReadX 12585 1124 4096 4096
ReadX 12585 3136 4096 4096
ReadX 12585 324 4096 4096
ReadX 12585 1156 4096 4096
ReadX 12585 1172 4096 4096
ReadX 12585 2112 4096 4096
ReadX 12585 2368 4096 4096
ReadX 12585 964 4096 4096
ReadX 12585 980 4096 4096
ReadX 12585 1012 4096 4096
ReadX 12585 532 4096 4096
ReadX 12585 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12585 1620 4096 4096
ReadX 12585 1604 4096 4096
ReadX 12585 2116 4096 4096
ReadX 12585 2132 4096 4096
ReadX 12585 2148 4096 4096
ReadX 12585 2276 4096 4096
ReadX 12585 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12602
Close 12602
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12604
QUERY_FILE_INFORMATION 12568
Close 12568
WriteX 12604 4088 1 1
QUERY_FILE_INFORMATION 12604
QUERY_FILE_INFORMATION 12570
Close 12570
WriteX 12604 0 65471 65471
WriteX 12604 65471 65 65
WriteX 12604 65536 64850 64850
Close 12604
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12606
WriteX 12606 15 1 1
QUERY_FILE_INFORMATION 12606
ReadX 12585 2068 4096 4096
ReadX 12585 1588 4096 4096
ReadX 12585 1572 4096 4096
WriteX 12606 0 18630 18630
Flush 12606
Close 12606
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12596
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12607
Close 12607
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12608
ReadX 12608 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 12585 612 4096 4096
ReadX 12585 564 4096 4096
ReadX 12585 1876 4096 4096
ReadX 12585 628 4096 4096
ReadX 12585 740 4096 4096
ReadX 12585 724 4096 4096
ReadX 12585 644 4096 4096
ReadX 12585 2324 4096 4096
ReadX 12585 660 4096 4096
ReadX 12585 852 4096 4096
ReadX 12585 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 12585 2368 4096 4096
ReadX 12585 1024 4096 4096
ReadX 12585 320 4096 4096
ReadX 12585 580 4096 4096
ReadX 12585 3136 512 512
ReadX 12585 2880 4096 4096
Close 12585
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12609
ReadX 12609 61440 4096 4096
ReadX 12609 126976 4096 4096
WriteX 12609 0 65471 65471
WriteX 12609 65471 65 65
WriteX 12609 65536 65471 65471
WriteX 12609 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12610
ReadX 12610 61440 4096 4096
ReadX 12610 126976 4096 4096
ReadX 12610 192512 4096 4096
ReadX 12610 258048 4096 4096
WriteX 12610 0 65471 65471
WriteX 12610 65471 65 65
WriteX 12610 65536 65471 65471
WriteX 12610 131007 65 65
WriteX 12610 131072 65471 65471
WriteX 12610 196543 65 65
WriteX 12610 196608 65471 65471
WriteX 12610 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12611
ReadX 12611 61440 4096 4096
ReadX 12611 126976 4096 4096
ReadX 12611 192512 4096 4096
ReadX 12611 258048 4096 4096
ReadX 12611 323584 4096 4096
ReadX 12611 389120 4096 4096
ReadX 12611 454656 4096 4096
ReadX 12611 520192 4096 4096
WriteX 12611 0 65471 65471
WriteX 12611 65471 65 65
WriteX 12611 65536 65471 65471
WriteX 12611 131007 65 65
WriteX 12611 131072 65471 65471
WriteX 12611 196543 65 65
WriteX 12611 196608 65471 65471
WriteX 12611 262079 65 65
WriteX 12611 262144 65471 65471
WriteX 12611 327615 65 65
WriteX 12611 327680 65471 65471
WriteX 12611 393151 65 65
WriteX 12611 393216 65471 65471
WriteX 12611 458687 65 65
WriteX 12611 458752 65471 65471
WriteX 12611 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12612
Close 12612
Close 12608
Close 12583
Close 12609
Close 12610
Close 12611
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12613
Close 12613
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 12616
Close 12616
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 12618
Close 12618
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 12619
Close 12619
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12622
Close 12622
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12624
Close 12624
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12625
Close 12625
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12628
Close 12628
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12632
Close 12632
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12636
Close 12636
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12640
Close 12640
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12644
Close 12644
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12648
Close 12648
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12652
Close 12652
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12656
Close 12656
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12658
Close 12658
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12660
Close 12660
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12662
WriteX 12662 4095 1 1
QUERY_FILE_INFORMATION 12662
QUERY_FS_INFORMATION 259
WriteX 12662 0 65471 65471
WriteX 12662 65471 65 65
WriteX 12662 65536 65471 65471
WriteX 12662 131007 65 65
WriteX 12662 131072 65471 65471
WriteX 12662 196543 65 65
WriteX 12662 196608 65471 65471
WriteX 12662 262079 65 65
WriteX 12662 262144 26634 26634
Close 12662
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12667
Close 12667
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12668
Close 12668
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12669
ReadX 12669 0 4096 4096
Close 12669
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12670
ReadX 12670 0 4096 4096
ReadX 12670 4096 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12671
Close 12671
Close 12670
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12674
Close 12674
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12676
Close 12676
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12677
Close 12677
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12680
Close 12680
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12682
Close 12682
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12683
Close 12683
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12686
Close 12686
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12690
Close 12690
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12694
Close 12694
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12698
Close 12698
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12702
Close 12702
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12706
Close 12706
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12709
Close 12709
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12713
Close 12713
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12717
Close 12717
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 12719
Close 12719
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 12720
Close 12720
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12729
Close 12729
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12730
FIND_FIRST \clients\client1\~dmtmp\*
Close 12730
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12731
Close 12731
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12732
ReadX 12732 0 4096 4096
Close 12732
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12733
ReadX 12733 0 4096 4096
Close 12733
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12734
ReadX 12734 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12744
Close 12744
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12745
FIND_FIRST \clients\client1\~dmtmp\*
Close 12745
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12746
Close 12746
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12747
ReadX 12747 0 4096 4096
Close 12747
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12748
ReadX 12748 0 4096 4096
Close 12748
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12749
ReadX 12749 0 4096 4096
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12750
ReadX 12750 0 65471 65471
ReadX 12750 65471 65 65
ReadX 12750 65536 65471 65471
ReadX 12750 131007 65 65
ReadX 12750 131072 65471 65471
ReadX 12750 196543 65 65
ReadX 12750 196608 65471 65471
ReadX 12750 262079 65 65
ReadX 12750 262144 65471 65471
ReadX 12750 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12751
ReadX 12751 0 65471 65471
ReadX 12751 65471 65 65
ReadX 12751 65536 65471 65471
ReadX 12751 131007 65 65
ReadX 12751 131072 65471 65471
ReadX 12751 196543 65 65
ReadX 12751 196608 65471 65471
ReadX 12751 262079 65 65
ReadX 12751 262144 65471 65471
ReadX 12751 327615 65 65
ReadX 12751 327680 65471 65471
ReadX 12751 393151 65 65
ReadX 12751 393216 65471 65471
ReadX 12751 458687 65 65
ReadX 12751 458752 65471 65471
ReadX 12751 524223 65 65
ReadX 12751 524288 65471 65471
ReadX 12751 589759 65 65
ReadX 12751 589824 65471 65471
ReadX 12751 655295 65 65
ReadX 12751 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12752
ReadX 12752 0 65471 65471
ReadX 12752 65471 65 65
ReadX 12752 65536 65471 65471
ReadX 12752 131007 65 65
ReadX 12752 131072 65471 65471
ReadX 12752 196543 65 65
ReadX 12752 196608 65471 65471
ReadX 12752 262079 65 65
ReadX 12752 262144 65471 65471
ReadX 12752 327615 65 65
ReadX 12752 327680 65471 65471
ReadX 12752 393151 65 65
ReadX 12752 393216 65471 65471
ReadX 12752 458687 65 65
ReadX 12752 458752 65471 65471
ReadX 12752 524223 65 65
ReadX 12752 524288 65471 65471
ReadX 12752 589759 65 65
ReadX 12752 589824 65471 65471
ReadX 12752 655295 65 65
ReadX 12752 655360 65471 65471
ReadX 12752 720831 65 65
ReadX 12752 720896 65471 65471
ReadX 12752 786367 65 65
ReadX 12752 786432 65471 65471
ReadX 12752 851903 65 65
ReadX 12752 851968 65471 65471
ReadX 12752 917439 65 65
ReadX 12752 917504 65471 65471
ReadX 12752 982975 65 65
ReadX 12752 983040 65471 65471
ReadX 12752 1048511 65 65
ReadX 12752 1048576 65471 65471
ReadX 12752 1114047 65 65
ReadX 12752 1114112 65471 65471
ReadX 12752 1179583 65 65
ReadX 12752 1179648 65471 65471
ReadX 12752 1245119 65 65
ReadX 12752 1245184 65471 65471
ReadX 12752 1310655 65 65
ReadX 12752 1310720 65471 65471
ReadX 12752 1376191 65 65
ReadX 12752 1376256 65471 65471
ReadX 12752 1441727 65 65
ReadX 12752 1441792 65471 65471
ReadX 12752 1507263 65 65
ReadX 12752 1507328 65471 65471
ReadX 12752 1572799 65 65
ReadX 12752 1572864 65471 65471
ReadX 12752 1638335 65 65
ReadX 12752 1638400 65471 65471
ReadX 12752 1703871 65 65
ReadX 12752 1703936 65471 65471
ReadX 12752 1769407 65 65
ReadX 12752 1769472 65471 65471
ReadX 12752 1834943 65 65
ReadX 12752 1835008 32768 32768
Close 12734
Close 12749
Close 12750
Close 12751
Close 12752
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12753
ReadX 12753 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12753 0 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12753 8192 4096 4096
ReadX 12753 12288 4096 4096
ReadX 12753 16384 4096 4096
ReadX 12753 20480 4096 4096
ReadX 12753 24576 4096 4096
ReadX 12753 28672 4096 4096
ReadX 12753 32768 4096 4096
ReadX 12753 36864 4096 4096
ReadX 12753 40960 4096 4096
ReadX 12753 45056 4096 4096
ReadX 12753 49152 4096 4096
ReadX 12753 53248 4096 4096
ReadX 12753 57344 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12753 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 12754
Close 12754
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 12755
WriteX 12755 1535 1 1
QUERY_FILE_INFORMATION 12755
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12753 0 4096 4096
ReadX 12753 4096 4096 4096
QUERY_FILE_INFORMATION 12755
WriteX 12755 0 57088 57088
WriteX 12755 0 4096 4096
Flush 12755
Close 12753
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12756
Close 12756
WriteX 12755 0 4096 4096
Close 12755
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 12757
Close 12757
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12758
ReadX 12758 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12758 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 12759
WriteX 12759 1535 1 1
QUERY_FILE_INFORMATION 12759
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12758 0 4096 4096
QUERY_FILE_INFORMATION 12759
WriteX 12759 0 51456 51456
WriteX 12759 0 4096 4096
Flush 12759
Close 12758
WriteX 12759 0 4096 4096
Close 12759
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 12760
Close 12760
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12761
ReadX 12761 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12761 4096 4096 4096
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12763
Close 12763
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12765
WriteX 12765 4045 1 1
QUERY_FILE_INFORMATION 12765
WriteX 12765 0 53077 53077
Close 12765
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 12766
WriteX 12766 1535 1 1
QUERY_FILE_INFORMATION 12766
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12761 0 4096 4096
QUERY_FILE_INFORMATION 12766
WriteX 12766 0 65471 65471
WriteX 12766 65471 65 65
WriteX 12766 65536 1856 1856
WriteX 12766 0 4096 4096
Flush 12766
Close 12761
WriteX 12766 0 4096 4096
Close 12766
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 12767
Close 12767
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12768
ReadX 12768 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12770
Close 12770
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12772
WriteX 12772 4076 1 1
QUERY_FILE_INFORMATION 12772
WriteX 12772 0 7983 7983
Close 12772
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12774
Close 12774
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12776
WriteX 12776 4095 1 1
QUERY_FILE_INFORMATION 12776
WriteX 12776 0 65471 65471
WriteX 12776 65471 65 65
WriteX 12776 65536 65471 65471
WriteX 12776 131007 65 65
WriteX 12776 131072 65471 65471
WriteX 12776 196543 65 65
WriteX 12776 196608 65471 65471
WriteX 12776 262079 65 65
WriteX 12776 262144 65471 65471
WriteX 12776 327615 65 65
WriteX 12776 327680 65471 65471
WriteX 12776 393151 65 65
WriteX 12776 393216 65471 65471
WriteX 12776 458687 65 65
WriteX 12776 458752 46731 46731
Close 12776
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 12777
WriteX 12777 1535 1 1
QUERY_FILE_INFORMATION 12777
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12768 0 4096 4096
ReadX 12768 4096 4096 4096
QUERY_FILE_INFORMATION 12777
WriteX 12777 0 65471 65471
WriteX 12777 65471 65 65
WriteX 12777 65536 22848 22848
WriteX 12777 0 4096 4096
Flush 12777
Close 12768
WriteX 12777 0 4096 4096
Close 12777
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 12778
Close 12778
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12779
ReadX 12779 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12779 4096 4096 4096
Close 12779
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12780
ReadX 12780 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12780 0 8192 8192
ReadX 12780 8192 4096 4096
ReadX 12780 12288 4096 4096
ReadX 12780 16384 4096 4096
ReadX 12780 20480 4096 4096
ReadX 12780 24576 4096 4096
ReadX 12780 28672 4096 4096
ReadX 12780 32768 4096 4096
ReadX 12780 36864 4096 4096
ReadX 12780 40960 4096 4096
ReadX 12780 45056 4096 4096
ReadX 12780 49152 4096 4096
ReadX 12780 53248 4096 4096
ReadX 12780 57344 4096 4096
ReadX 12780 61440 4096 4096
ReadX 12780 65536 4096 4096
ReadX 12780 69632 4096 4096
ReadX 12780 73728 4096 4096
ReadX 12780 77824 4096 4096
ReadX 12780 81920 4096 4096
ReadX 12780 86016 4096 4096
ReadX 12780 90112 4096 4096
ReadX 12780 94208 4096 4096
ReadX 12780 98304 4096 4096
ReadX 12780 102400 4096 4096
ReadX 12780 106496 4096 4096
ReadX 12780 110592 4096 4096
ReadX 12780 114688 4096 4096
ReadX 12780 118784 4096 4096
ReadX 12780 122880 4096 4096
ReadX 12780 126976 4096 4096
ReadX 12780 131072 4096 4096
ReadX 12780 135168 4096 4096
ReadX 12780 139264 4096 4096
ReadX 12780 143360 4096 4096
ReadX 12780 147456 4096 4096
ReadX 12780 151552 4096 4096
ReadX 12780 155648 4096 4096
ReadX 12780 159744 4096 4096
ReadX 12780 163840 4096 4096
ReadX 12780 167936 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 12780 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 12781
Close 12781
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 12782
WriteX 12782 2047 1 1
QUERY_FILE_INFORMATION 12782
Close 12780
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12783
Close 12783
WriteX 12782 0 42388 42388
Close 12782
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 12784
Close 12784
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12785
ReadX 12785 0 4096 4096
ReadX 12785 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 12786
WriteX 12786 2047 1 1
QUERY_FILE_INFORMATION 12786
Close 12785
WriteX 12786 0 42652 42652
Close 12786
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 12787
Close 12787
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12788
ReadX 12788 0 4096 4096
ReadX 12788 4096 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12790
Close 12790
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12792
WriteX 12792 4080 1 1
QUERY_FILE_INFORMATION 12792
WriteX 12792 0 65471 65471
WriteX 12792 65471 65 65
WriteX 12792 65536 49 49
Close 12792
Close 12788
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12793
ReadX 12793 61440 4096 4096
ReadX 12793 126976 4096 4096
WriteX 12793 0 65471 65471
WriteX 12793 65471 65 65
WriteX 12793 65536 65471 65471
WriteX 12793 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12794
ReadX 12794 61440 4096 4096
ReadX 12794 126976 4096 4096
ReadX 12794 192512 4096 4096
ReadX 12794 258048 4096 4096
WriteX 12794 0 65471 65471
WriteX 12794 65471 65 65
WriteX 12794 65536 65471 65471
WriteX 12794 131007 65 65
WriteX 12794 131072 65471 65471
WriteX 12794 196543 65 65
WriteX 12794 196608 65471 65471
WriteX 12794 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12795
ReadX 12795 61440 4096 4096
ReadX 12795 126976 4096 4096
ReadX 12795 192512 4096 4096
ReadX 12795 258048 4096 4096
ReadX 12795 323584 4096 4096
ReadX 12795 389120 4096 4096
ReadX 12795 454656 4096 4096
ReadX 12795 520192 4096 4096
WriteX 12795 0 65471 65471
WriteX 12795 65471 65 65
WriteX 12795 65536 65471 65471
WriteX 12795 131007 65 65
WriteX 12795 131072 65471 65471
WriteX 12795 196543 65 65
WriteX 12795 196608 65471 65471
WriteX 12795 262079 65 65
WriteX 12795 262144 65471 65471
WriteX 12795 327615 65 65
WriteX 12795 327680 65471 65471
WriteX 12795 393151 65 65
WriteX 12795 393216 65471 65471
WriteX 12795 458687 65 65
WriteX 12795 458752 65471 65471
WriteX 12795 524223 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12796
FIND_FIRST \clients\client1\~dmtmp\*
Close 12796
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12797
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12797 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12798
ReadX 12798 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12799
ReadX 12799 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12800
ReadX 12800 0 4096 4096
ReadX 12797 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12797
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12801
ReadX 12801 0 4096 4096
ReadX 12801 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12802
FIND_FIRST \clients\client1\~dmtmp\*
Close 12802
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 12803
QUERY_FILE_INFORMATION 12803
WriteX 12803 2047 1 1
QUERY_FILE_INFORMATION 12803
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 12804
Close 12804
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12805
WriteX 12805 52 1 1
QUERY_FILE_INFORMATION 12805
WriteX 12805 0 491 491
Close 12805
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12806
ReadX 12806 0 491 491
WriteX 12803 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 12801
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12807
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12807 0 4096 4096
ReadX 12807 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 12809
Close 12809
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12810
WriteX 12810 52 1 1
QUERY_FILE_INFORMATION 12810
WriteX 12810 0 543 543
Close 12810
Close 12807
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12811
ReadX 12811 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12812
ReadX 12812 0 543 543
ReadX 12811 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12811
Close 12806
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12793
Close 12794
Close 12795
Close 12812
Close 12798
Close 12799
Close 12800
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12803
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12813
FIND_FIRST \clients\client1\~dmtmp\*
Close 12813
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12814
ReadX 12814 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12815
ReadX 12815 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12816
ReadX 12816 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12817
ReadX 12817 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12818
ReadX 12818 0 543 543
ReadX 12814 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 12822
FIND_FIRST \clients\client1\~dmtmp\*
Close 12822
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12823
QUERY_FILE_INFORMATION 12823
WriteX 12823 2047 1 1
QUERY_FILE_INFORMATION 12823
WriteX 12823 0 2048 2048
Close 12823
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12824
ReadX 12824 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12824
Close 12814
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12825
ReadX 12825 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 12825 4095 1 1
QUERY_FILE_INFORMATION 12825
ReadX 12825 0 4096 4096
WriteX 12825 0 4096 4096
Flush 12825
WriteX 12825 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12826
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12826 0 4096 4096
ReadX 12826 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 12830
FIND_FIRST \clients\client1\~dmtmp\*
Close 12830
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12831
WriteX 12831 2047 1 1
QUERY_FILE_INFORMATION 12831
WriteX 12831 0 2048 2048
Close 12831
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12832
ReadX 12832 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 12836
Close 12836
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12837
WriteX 12837 2047 1 1
QUERY_FILE_INFORMATION 12837
WriteX 12837 0 2048 2048
Close 12837
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12838
ReadX 12838 0 2048 2048
ReadX 12826 4096 16384 16384
Close 12838
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12839
ReadX 12839 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
Close 12839
Close 12818
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 12832 4095 1 1
QUERY_FILE_INFORMATION 12832
ReadX 12832 0 4096 4096
WriteX 12832 0 4096 4096
Close 12832
WriteX 12826 0 8192 8192
Close 12826
WriteX 12815 0 4096 4096
WriteX 12816 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12841
ReadX 12841 0 4096 4096
ReadX 12841 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12841
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12842
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12842 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12843
ReadX 12843 0 543 543
ReadX 12842 0 4096 4096
Close 12842
Close 12825
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12844
QUERY_FILE_INFORMATION 12844
Close 12844
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12843
Close 12815
Close 12816
Close 12817
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12845
FIND_FIRST \clients\client1\~dmtmp\*
Close 12845
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12846
ReadX 12846 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12847
ReadX 12847 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12848
ReadX 12848 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12849
ReadX 12849 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12850
ReadX 12850 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12851
ReadX 12851 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12852
ReadX 12852 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12853
ReadX 12853 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12854
ReadX 12854 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12855
ReadX 12855 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12856
ReadX 12856 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12857
ReadX 12857 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12858
ReadX 12858 0 4096 4096
ReadX 12846 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12862
FIND_FIRST \clients\client1\~dmtmp\*
Close 12862
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12863
QUERY_FILE_INFORMATION 12863
WriteX 12863 2047 1 1
QUERY_FILE_INFORMATION 12863
WriteX 12863 0 2048 2048
Close 12863
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12864
ReadX 12864 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12864
Close 12854
Close 12846
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12865
ReadX 12865 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12866
FIND_FIRST \clients\client1\~dmtmp\*
Close 12866
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12867
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12867 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12868
ReadX 12868 0 4096 4096
ReadX 12867 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12872
FIND_FIRST \clients\client1\~dmtmp\*
Close 12872
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12873
QUERY_FILE_INFORMATION 12873
WriteX 12873 2047 1 1
QUERY_FILE_INFORMATION 12873
WriteX 12873 0 2048 2048
Close 12873
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12874
ReadX 12874 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12874
Close 12867
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12875
ReadX 12875 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12865 4095 1 1
QUERY_FILE_INFORMATION 12865
ReadX 12865 0 4096 4096
WriteX 12865 0 4096 4096
Flush 12865
WriteX 12875 4095 1 1
QUERY_FILE_INFORMATION 12875
ReadX 12875 0 4096 4096
WriteX 12875 0 4096 4096
Flush 12875
WriteX 12865 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
WriteX 12875 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12876
ReadX 12876 0 4096 4096
ReadX 12868 0 4096 4096
ReadX 12876 0 4096 4096
ReadX 12876 4096 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12877
FIND_FIRST \clients\client1\~dmtmp\*
Close 12877
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12878
WriteX 12878 4095 1 1
QUERY_FILE_INFORMATION 12878
WriteX 12878 0 4096 4096
Close 12878
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12879
ReadX 12879 0 4096 4096
Close 12876
Close 12868
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12880
Close 12880
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12881
WriteX 12881 4095 1 1
QUERY_FILE_INFORMATION 12881
WriteX 12881 0 4096 4096
Close 12881
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12882
ReadX 12882 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
WriteX 12882 0 4096 4096
Close 12879
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12858
Close 12852
Close 12855
Close 12856
Close 12857
Close 12853
Close 12847
Close 12850
Close 12851
Close 12848
Close 12849
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12882
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12884
Close 12884
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12885
ReadX 12885 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12886
Close 12886
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12887
WriteX 12887 2047 1 1
QUERY_FILE_INFORMATION 12887
WriteX 12887 0 2048 2048
Close 12887
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12888
ReadX 12888 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12888
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12889
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12889 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12890
ReadX 12890 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12891
ReadX 12891 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12892
ReadX 12892 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12893
ReadX 12893 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12894
ReadX 12894 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12895
ReadX 12895 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12896
ReadX 12896 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12897
ReadX 12897 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12898
ReadX 12898 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12899
ReadX 12899 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12900
ReadX 12900 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12901
ReadX 12901 0 4096 4096
ReadX 12889 0 4096 4096
ReadX 12896 0 4096 4096
Close 12896
Close 12889
Close 12865
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12902
QUERY_FILE_INFORMATION 12902
Close 12902
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12885
Close 12900
Close 12895
Close 12897
Close 12898
Close 12899
Close 12901
Close 12890
Close 12893
Close 12894
Close 12891
Close 12892
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12875
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12903
QUERY_FILE_INFORMATION 12903
Close 12903
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12904
FIND_FIRST \clients\client1\~dmtmp\*
Close 12904
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12905
ReadX 12905 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12906
ReadX 12906 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12907
ReadX 12907 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12908
ReadX 12908 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12909
ReadX 12909 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12910
ReadX 12910 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12911
ReadX 12911 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12912
ReadX 12912 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12913
ReadX 12913 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12914
ReadX 12914 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12915
ReadX 12915 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12916
ReadX 12916 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12917
ReadX 12917 0 4096 4096
ReadX 12905 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12921
FIND_FIRST \clients\client1\~dmtmp\*
Close 12921
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12922
QUERY_FILE_INFORMATION 12922
WriteX 12922 2047 1 1
QUERY_FILE_INFORMATION 12922
WriteX 12922 0 2048 2048
Close 12922
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12923
ReadX 12923 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12923
Close 12905
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12924
ReadX 12924 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12925
FIND_FIRST \clients\client1\~dmtmp\*
Close 12925
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12926
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12926 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12927
ReadX 12927 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12928
ReadX 12928 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12929
ReadX 12929 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12930
ReadX 12930 0 543 543
ReadX 12926 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12934
FIND_FIRST \clients\client1\~dmtmp\*
Close 12934
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12935
QUERY_FILE_INFORMATION 12935
WriteX 12935 2047 1 1
QUERY_FILE_INFORMATION 12935
WriteX 12935 0 2048 2048
Close 12935
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12936
ReadX 12936 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12936
Close 12926
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12937
ReadX 12937 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
Close 12910
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12938
FIND_FIRST \clients\client1\~dmtmp\*
Close 12938
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12939
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12939 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12940
ReadX 12940 0 4096 4096
ReadX 12939 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12944
FIND_FIRST \clients\client1\~dmtmp\*
Close 12944
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12945
QUERY_FILE_INFORMATION 12945
WriteX 12945 2047 1 1
QUERY_FILE_INFORMATION 12945
WriteX 12945 0 2048 2048
Close 12945
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12946
ReadX 12946 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12946
Close 12940
Close 12939
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12947
ReadX 12947 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12924 4095 1 1
QUERY_FILE_INFORMATION 12924
ReadX 12924 0 4096 4096
WriteX 12924 0 4096 4096
Flush 12924
WriteX 12937 4095 1 1
QUERY_FILE_INFORMATION 12937
ReadX 12937 0 4096 4096
WriteX 12937 0 4096 4096
Flush 12937
WriteX 12947 4095 1 1
QUERY_FILE_INFORMATION 12947
ReadX 12947 0 4096 4096
WriteX 12947 0 4096 4096
Flush 12947
WriteX 12924 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
WriteX 12937 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
WriteX 12947 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12948
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12948 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12949
ReadX 12949 0 4096 4096
ReadX 12948 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12950
ReadX 12950 0 4096 4096
ReadX 12950 0 4096 4096
ReadX 12950 4096 16384 16384
ReadX 12948 4096 16384 16384
ReadX 12948 0 4096 4096
ReadX 12949 0 4096 4096
ReadX 12949 4096 4096 4096
Close 12950
Close 12949
Close 12948
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12951
FIND_FIRST \clients\client1\~dmtmp\*
Close 12951
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12952
ReadX 12952 0 2048 2048
WriteX 12952 18431 1 1
QUERY_FILE_INFORMATION 12952
WriteX 12952 0 19584 19584
Close 12952
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12953
ReadX 12953 0 4096 4096
ReadX 12953 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12953
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12954
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12954 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12955
ReadX 12955 0 4096 4096
ReadX 12954 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12956
ReadX 12956 0 4096 4096
ReadX 12956 0 4096 4096
Close 12956
Close 12955
Close 12954
Close 12924
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12957
QUERY_FILE_INFORMATION 12957
Close 12957
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12930
Close 12917
Close 12909
Close 12927
Close 12928
Close 12929
Close 12916
Close 12911
Close 12914
Close 12915
Close 12912
Close 12913
Close 12906
Close 12907
Close 12908
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12937
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12958
QUERY_FILE_INFORMATION 12958
Close 12958
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12959
QUERY_FILE_INFORMATION 12959
Close 12959
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12960
FIND_FIRST \clients\client1\~dmtmp\*
Close 12960
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12961
ReadX 12961 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12962
ReadX 12962 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12963
ReadX 12963 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12964
ReadX 12964 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12965
ReadX 12965 0 543 543
ReadX 12961 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12961 4096 16384 16384
WriteX 12961 0 4096 4096
Close 12961
WriteX 12962 0 4096 4096
WriteX 12963 0 4096 4096
WriteX 12964 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12966
FIND_FIRST \clients\client1\~dmtmp\*
Close 12966
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12967
ReadX 12967 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12968
ReadX 12968 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12969
ReadX 12969 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12970
ReadX 12970 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12971
ReadX 12971 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12972
ReadX 12972 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12973
ReadX 12973 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12974
ReadX 12974 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12975
ReadX 12975 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12976
ReadX 12976 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12977
ReadX 12977 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12978
ReadX 12978 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12979
ReadX 12979 0 4096 4096
ReadX 12967 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12980
ReadX 12980 0 8192 8192
ReadX 12967 4096 16384 16384
Close 12974
Close 12967
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12981
FIND_FIRST \clients\client1\~dmtmp\*
Close 12981
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12982
ReadX 12982 0 4096 4096
ReadX 12982 4096 4096 4096
ReadX 12982 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12983
ReadX 12983 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12984
ReadX 12984 0 4096 4096
ReadX 12983 0 4096 4096
ReadX 12983 0 4096 4096
ReadX 12983 4096 16384 16384
Close 12984
WriteX 12983 0 4096 4096
Close 12983
WriteX 12968 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12985
FIND_FIRST \clients\client1\~dmtmp\*
Close 12985
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12986
ReadX 12986 0 4096 4096
ReadX 12986 4096 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12987
ReadX 12987 0 4096 4096
ReadX 12987 0 4096 4096
WriteX 12987 0 4096 4096
Close 12987
WriteX 12962 0 4096 4096
WriteX 12963 0 4096 4096
WriteX 12964 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12988
ReadX 12988 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12989
ReadX 12989 0 4096 4096
ReadX 12988 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12993
FIND_FIRST \clients\client1\~dmtmp\*
Close 12993
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12994
QUERY_FILE_INFORMATION 12994
WriteX 12994 2047 1 1
QUERY_FILE_INFORMATION 12994
WriteX 12994 0 2048 2048
Close 12994
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12995
ReadX 12995 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12995 4095 1 1
QUERY_FILE_INFORMATION 12995
ReadX 12995 0 4096 4096
WriteX 12995 0 4096 4096
Close 12995
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12996
ReadX 12996 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12996 0 4096 4096
Close 12989
Close 12988
WriteX 12996 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12997
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12997 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12998
ReadX 12998 0 4096 4096
ReadX 12997 0 4096 4096
ReadX 12997 4096 16384 16384
Close 12998
Close 12997
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12999
FIND_FIRST \clients\client1\~dmtmp\*
Close 12999
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13000
ReadX 13000 0 4096 4096
ReadX 13000 4096 4096 4096
WriteX 13000 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13000 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13000
ReadX 12996 0 4096 4096
WriteX 12996 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13001
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13001 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13002
ReadX 13002 0 4096 4096
ReadX 13001 0 4096 4096
ReadX 13001 4096 16384 16384
Close 13002
Close 13001
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13003
FIND_FIRST \clients\client1\~dmtmp\*
Close 13003
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13004
ReadX 13004 0 4096 4096
ReadX 13004 4096 4096 4096
WriteX 13004 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
ReadX 13004 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13004
Close 12996
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13005
QUERY_FILE_INFORMATION 13005
Close 13005
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Close 12980
Close 12982
Close 12986
Close 12965
Close 12962
Close 12963
Close 12964
Close 12973
Close 12978
Close 12975
Close 12976
Close 12977
Close 12979
Close 12968
Close 12971
Close 12972
Close 12969
Close 12970
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13006
FIND_FIRST \clients\client1\~dmtmp\*
Close 13006
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13007
ReadX 13007 0 4096 4096
ReadX 13007 4096 4096 4096
ReadX 13007 8192 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13008
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13008 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13009
ReadX 13009 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13010
ReadX 13010 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13011
ReadX 13011 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13012
ReadX 13012 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13013
ReadX 13013 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13014
ReadX 13014 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13015
ReadX 13015 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13016
ReadX 13016 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13017
ReadX 13017 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13018
ReadX 13018 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13019
ReadX 13019 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13020
ReadX 13020 0 4096 4096
ReadX 13008 0 4096 4096
ReadX 13008 0 4096 4096
ReadX 13008 4096 16384 16384
Close 13015
Close 13008
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13021
ReadX 13021 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13022
ReadX 13022 0 4096 4096
ReadX 13021 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13026
FIND_FIRST \clients\client1\~dmtmp\*
Close 13026
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13027
QUERY_FILE_INFORMATION 13027
WriteX 13027 2047 1 1
QUERY_FILE_INFORMATION 13027
WriteX 13027 0 2048 2048
Close 13027
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13028
ReadX 13028 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13028 4095 1 1
QUERY_FILE_INFORMATION 13028
ReadX 13028 0 4096 4096
WriteX 13028 0 4096 4096
Close 13028
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13029
ReadX 13029 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13029 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13033
Close 13033
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13034
QUERY_FILE_INFORMATION 13034
WriteX 13034 2047 1 1
QUERY_FILE_INFORMATION 13034
WriteX 13034 0 2048 2048
Close 13034
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13035
ReadX 13035 0 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13035 4095 1 1
QUERY_FILE_INFORMATION 13035
ReadX 13035 0 4096 4096
WriteX 13035 0 4096 4096
Close 13035
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13036
ReadX 13036 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13036 0 4096 4096
Close 13021
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13037
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13037 0 4096 4096
ReadX 13037 0 4096 4096
ReadX 13037 4096 16384 16384
Close 13037
Close 13029
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13038
QUERY_FILE_INFORMATION 13038
Close 13038
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13007
Close 13019
Close 13014
Close 13020
Close 13022
Close 13009
Close 13012
Close 13013
Close 13010
Close 13011
Close 13016
Close 13017
Close 13018
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13036
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13039
QUERY_FILE_INFORMATION 13039
Close 13039
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13040
ReadX 13040 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13041
Close 13041
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13042
WriteX 13042 63 1 1
QUERY_FILE_INFORMATION 13042
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13040 0 4096 4096
ReadX 13040 4096 8192 8192
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13040 0 8192 8192
Flush 13040
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13040 12288 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13040 0 8192 8192
Flush 13040
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13040 0 8192 8192
Flush 13040
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
WriteX 13040 0 8192 8192
Flush 13040
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13044
Close 13044
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13046
WriteX 13046 4065 1 1
QUERY_FILE_INFORMATION 13046
WriteX 13046 0 62591 62591
Close 13046
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13048
Close 13048
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13050
WriteX 13050 4094 1 1
QUERY_FILE_INFORMATION 13050
WriteX 13050 0 10845 10845
Close 13050
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13052
Close 13052
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13054
WriteX 13054 4081 1 1
QUERY_FILE_INFORMATION 13054
WriteX 13054 0 30118 30118
Close 13054
WriteX 13040 0 4096 4096
Close 13040
WriteX 13042 0 64 64
Close 13042
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13055
ReadX 13055 61440 4096 4096
ReadX 13055 126976 4096 4096
WriteX 13055 0 65471 65471
WriteX 13055 65471 65 65
WriteX 13055 65536 65471 65471
WriteX 13055 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13056
ReadX 13056 61440 4096 4096
ReadX 13056 126976 4096 4096
ReadX 13056 192512 4096 4096
ReadX 13056 258048 4096 4096
WriteX 13056 0 65471 65471
WriteX 13056 65471 65 65
WriteX 13056 65536 65471 65471
WriteX 13056 131007 65 65
WriteX 13056 131072 65471 65471
WriteX 13056 196543 65 65
WriteX 13056 196608 65471 65471
WriteX 13056 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13057
ReadX 13057 61440 4096 4096
ReadX 13057 126976 4096 4096
ReadX 13057 192512 4096 4096
ReadX 13057 258048 4096 4096
ReadX 13057 323584 4096 4096
ReadX 13057 389120 4096 4096
ReadX 13057 454656 4096 4096
ReadX 13057 520192 4096 4096
WriteX 13057 0 65471 65471
WriteX 13057 65471 65 65
WriteX 13057 65536 65471 65471
WriteX 13057 131007 65 65
WriteX 13057 131072 65471 65471
WriteX 13057 196543 65 65
WriteX 13057 196608 65471 65471
WriteX 13057 262079 65 65
WriteX 13057 262144 65471 65471
WriteX 13057 327615 65 65
WriteX 13057 327680 65471 65471
WriteX 13057 393151 65 65
WriteX 13057 393216 65471 65471
WriteX 13057 458687 65 65
WriteX 13057 458752 65471 65471
WriteX 13057 524223 65 65
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13058
Close 13058
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13055
Close 13056
Close 13057
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13059
ReadX 13059 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13060
ReadX 13060 0 4096 4096
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13061
ReadX 13061 0 4096 4096
ReadX 13061 4096 4096 4096
ReadX 13061 8192 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13062
Close 13062
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13059
Close 13060
Close 13061
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13063
Close 13063
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13064
ReadX 13064 0 8192 8192
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13065
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
Close 13065
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13066
Close 13066
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13067
ReadX 13067 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13068
Close 13068
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13064
Close 13067
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13069
Close 13069
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13070
ReadX 13070 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13071
ReadX 13071 0 8192 8192
ReadX 13071 8192 8192 8192
ReadX 13071 16384 8192 8192
ReadX 13071 24576 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13073
Close 13073
Close 13070
Close 13071
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13075
WriteX 13075 8191 1 1
QUERY_FILE_INFORMATION 13075
WriteX 13075 0 10438 10438
Close 13075
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13076
Close 13076
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13077
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13078
Close 13078
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13079
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13080
Close 13080
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13081
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13082
FIND_FIRST \clients\client1\~dmtmp\*
Close 13082
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13083
Close 13083
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13084
ReadX 13084 0 4096 4096
Close 13084
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13085
ReadX 13085 0 8192 8192
Close 13085
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13086
ReadX 13086 0 8192 8192
ReadX 13086 8192 4096 4096
ReadX 13086 12288 8192 8192
ReadX 13086 20480 8192 8192
ReadX 13086 28672 8192 8192
ReadX 13086 36864 8192 8192
ReadX 13086 45056 8192 8192
ReadX 13086 53248 8192 8192
ReadX 13086 61440 8192 8192
ReadX 13086 69632 8192 8192
ReadX 13086 77824 8192 8192
ReadX 13086 86016 8192 8192
ReadX 13086 94208 8192 8192
ReadX 13086 102400 8192 8192
ReadX 13086 110592 8192 8192
ReadX 13086 118784 8192 8192
ReadX 13086 126976 8192 8192
ReadX 13086 135168 8192 8192
ReadX 13086 143360 8192 8192
ReadX 13086 151552 8192 8192
ReadX 13086 159744 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13087
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13087
Close 13086
Close 13077
Close 13079
Close 13081
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13088
Close 13088
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13090
WriteX 13090 8191 1 1
QUERY_FILE_INFORMATION 13090
WriteX 13090 0 28489 28489
Close 13090
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13091
Close 13091
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13092
FIND_FIRST \clients\client1\~dmtmp\*
Close 13092
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13093
Close 13093
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13094
ReadX 13094 0 8192 8192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13095
Close 13095
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13094
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13096
Close 13096
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13097
ReadX 13097 0 8192 8192
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13098
ReadX 13098 0 8192 8192
ReadX 13098 8192 8192 8192
ReadX 13098 16384 8192 8192
ReadX 13098 24576 8192 8192
ReadX 13098 32768 16384 16384
ReadX 13098 49152 8192 8192
ReadX 13098 57344 8192 8192
ReadX 13098 65536 8192 8192
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13100
Close 13100
Close 13097
Close 13098
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13102
WriteX 13102 8191 1 1
QUERY_FILE_INFORMATION 13102
WriteX 13102 0 29253 29253
Close 13102
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13103
Close 13103
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13104
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13105
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13105
Close 13104
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13106
Close 13106
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13108
WriteX 13108 8191 1 1
QUERY_FILE_INFORMATION 13108
WriteX 13108 0 30183 30183
Close 13108
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13109
Close 13109
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13110
WriteX 13110 0 510 510
WriteX 13110 510 512 512
WriteX 13110 1022 510 510
WriteX 13110 1532 510 510
WriteX 13110 2042 168 168
Close 13110
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13111
Close 13111
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13112
ReadX 13112 0 4096 4096
WriteX 13112 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13113
ReadX 13113 0 65471 65471
ReadX 13113 65471 65 65
ReadX 13113 65536 65471 65471
ReadX 13113 131007 65 65
ReadX 13113 131072 65471 65471
ReadX 13113 196543 65 65
ReadX 13113 196608 65471 65471
ReadX 13113 262079 65 65
ReadX 13113 262144 65471 65471
ReadX 13113 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13114
ReadX 13114 0 65471 65471
ReadX 13114 65471 65 65
ReadX 13114 65536 65471 65471
ReadX 13114 131007 65 65
ReadX 13114 131072 65471 65471
ReadX 13114 196543 65 65
ReadX 13114 196608 65471 65471
ReadX 13114 262079 65 65
ReadX 13114 262144 65471 65471
ReadX 13114 327615 65 65
ReadX 13114 327680 65471 65471
ReadX 13114 393151 65 65
ReadX 13114 393216 65471 65471
ReadX 13114 458687 65 65
ReadX 13114 458752 65471 65471
ReadX 13114 524223 65 65
ReadX 13114 524288 65471 65471
ReadX 13114 589759 65 65
ReadX 13114 589824 65471 65471
ReadX 13114 655295 65 65
ReadX 13114 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13115
ReadX 13115 0 65471 65471
ReadX 13115 65471 65 65
ReadX 13115 65536 65471 65471
ReadX 13115 131007 65 65
ReadX 13115 131072 65471 65471
ReadX 13115 196543 65 65
ReadX 13115 196608 65471 65471
ReadX 13115 262079 65 65
ReadX 13115 262144 65471 65471
ReadX 13115 327615 65 65
ReadX 13115 327680 65471 65471
ReadX 13115 393151 65 65
ReadX 13115 393216 65471 65471
ReadX 13115 458687 65 65
ReadX 13115 458752 65471 65471
ReadX 13115 524223 65 65
ReadX 13115 524288 65471 65471
ReadX 13115 589759 65 65
ReadX 13115 589824 65471 65471
ReadX 13115 655295 65 65
ReadX 13115 655360 65471 65471
ReadX 13115 720831 65 65
ReadX 13115 720896 65471 65471
ReadX 13115 786367 65 65
ReadX 13115 786432 65471 65471
ReadX 13115 851903 65 65
ReadX 13115 851968 65471 65471
ReadX 13115 917439 65 65
ReadX 13115 917504 65471 65471
ReadX 13115 982975 65 65
ReadX 13115 983040 65471 65471
ReadX 13115 1048511 65 65
ReadX 13115 1048576 65471 65471
ReadX 13115 1114047 65 65
ReadX 13115 1114112 65471 65471
ReadX 13115 1179583 65 65
ReadX 13115 1179648 65471 65471
ReadX 13115 1245119 65 65
ReadX 13115 1245184 65471 65471
ReadX 13115 1310655 65 65
ReadX 13115 1310720 65471 65471
ReadX 13115 1376191 65 65
ReadX 13115 1376256 65471 65471
ReadX 13115 1441727 65 65
ReadX 13115 1441792 65471 65471
ReadX 13115 1507263 65 65
ReadX 13115 1507328 65471 65471
ReadX 13115 1572799 65 65
ReadX 13115 1572864 65471 65471
ReadX 13115 1638335 65 65
ReadX 13115 1638400 65471 65471
ReadX 13115 1703871 65 65
ReadX 13115 1703936 65471 65471
ReadX 13115 1769407 65 65
ReadX 13115 1769472 65471 65471
ReadX 13115 1834943 65 65
ReadX 13115 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13116
ReadX 13116 0 4096 4096
ReadX 13116 0 8192 8192
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13117
WriteX 13117 52 1 1
QUERY_FILE_INFORMATION 13117
WriteX 13117 0 53 53
Close 13117
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13118
Close 13118
Close 13112
Close 13113
Close 13114
Close 13115
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13116 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13119
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13116 0 4096 4096
ReadX 13116 4096 4096 4096
ReadX 13116 8192 4096 4096
ReadX 13116 12288 4096 4096
WriteX 13119 15359 1 1
QUERY_FILE_INFORMATION 13119
ReadX 13116 16384 4096 4096
ReadX 13116 20480 4096 4096
WriteX 13119 0 15360 15360
Close 13119
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13120
ReadX 13120 0 4096 4096
WriteX 13120 0 4096 4096
Close 13120
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13121
Close 13121
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13122
ReadX 13122 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13123
Close 13123
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13116
ReadX 13122 0 4096 4096
ReadX 13122 4096 4096 4096
ReadX 13122 8192 4096 4096
ReadX 13122 12288 3072 3072
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13124
ReadX 13124 0 4096 4096
ReadX 13124 0 4096 4096
ReadX 13124 4096 4096 4096
ReadX 13124 0 4096 4096
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13125
ReadX 13125 0 4096 4096
ReadX 13125 4096 4096 4096
ReadX 13125 8192 4096 4096
Close 13124
Close 13125
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13126
WriteX 13126 15359 1 1
QUERY_FILE_INFORMATION 13126
WriteX 13126 0 15360 15360
Close 13126
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13127
ReadX 13127 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13122
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13128
Close 13128
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13129
ReadX 13129 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13130
Close 13130
WriteX 13127 0 4096 4096
Close 13127
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13131
Close 13131
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13132
ReadX 13132 0 4096 4096
ReadX 13132 0 4096 4096
ReadX 13132 4096 4096 4096
ReadX 13132 8192 4096 4096
ReadX 13132 12288 3072 3072
ReadX 13132 0 8192 8192
ReadX 13132 8192 4096 4096
ReadX 13132 12288 3072 3072
WriteX 13132 15469 1 1
QUERY_FILE_INFORMATION 13132
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13133
ReadX 13133 0 4096 4096
ReadX 13133 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13134
WriteX 13134 52 1 1
QUERY_FILE_INFORMATION 13134
WriteX 13134 0 53 53
Close 13134
WriteX 13132 0 19054 19054
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13135
Close 13135
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13136
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13133 0 8192 8192
ReadX 13133 8192 4096 4096
ReadX 13133 12288 4096 4096
WriteX 13136 12005 1 1
QUERY_FILE_INFORMATION 13136
WriteX 13136 0 12006 12006
Close 13136
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13137
ReadX 13137 0 4096 4096
WriteX 13137 0 4096 4096
Close 13137
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13138
Close 13138
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13139
ReadX 13139 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13140
Close 13140
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13133
ReadX 13139 0 4096 4096
ReadX 13139 4096 4096 4096
ReadX 13139 8192 3814 3814
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13141
WriteX 13141 11990 1 1
QUERY_FILE_INFORMATION 13141
WriteX 13141 0 11991 11991
Close 13141
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13142
ReadX 13142 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13139
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13143
Close 13143
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13144
ReadX 13144 0 4096 4096
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13145
Close 13145
WriteX 13142 0 4096 4096
Close 13142
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13146
Close 13146
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13147
ReadX 13147 0 4096 4096
ReadX 13147 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13148
Close 13148
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13147 0 8192 8192
ReadX 13147 8192 3799 3799
WriteX 13147 13247 1 1
QUERY_FILE_INFORMATION 13147
WriteX 13147 0 14984 14984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13147 0 8192 8192
ReadX 13147 8192 4096 4096
Close 13129
Close 13132
WriteX 13147 0 12288 12288
Close 13147
Close 13144
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13149
Close 13149
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13150
Close 13150
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13151
ReadX 13151 61440 4096 4096
ReadX 13151 126976 4096 4096
WriteX 13151 0 65471 65471
WriteX 13151 65471 65 65
WriteX 13151 65536 65471 65471
WriteX 13151 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13152
ReadX 13152 61440 4096 4096
ReadX 13152 126976 4096 4096
ReadX 13152 192512 4096 4096
ReadX 13152 258048 4096 4096
WriteX 13152 0 65471 65471
WriteX 13152 65471 65 65
WriteX 13152 65536 65471 65471
WriteX 13152 131007 65 65
WriteX 13152 131072 65471 65471
WriteX 13152 196543 65 65
WriteX 13152 196608 65471 65471
WriteX 13152 262079 65 65
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13153
ReadX 13153 61440 4096 4096
ReadX 13153 126976 4096 4096
ReadX 13153 192512 4096 4096
ReadX 13153 258048 4096 4096
ReadX 13153 323584 4096 4096
ReadX 13153 389120 4096 4096
ReadX 13153 454656 4096 4096
ReadX 13153 520192 4096 4096
WriteX 13153 0 65471 65471
WriteX 13153 65471 65 65
WriteX 13153 65536 65471 65471
WriteX 13153 131007 65 65
WriteX 13153 131072 65471 65471
WriteX 13153 196543 65 65
WriteX 13153 196608 65471 65471
WriteX 13153 262079 65 65
WriteX 13153 262144 65471 65471
WriteX 13153 327615 65 65
WriteX 13153 327680 65471 65471
WriteX 13153 393151 65 65
WriteX 13153 393216 65471 65471
WriteX 13153 458687 65 65
WriteX 13153 458752 65471 65471
WriteX 13153 524223 65 65
Close 13151
Close 13152
Close 13153
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13154
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13154 0 4096 4096
Close 13154
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13155
ReadX 13155 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13155
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13156
ReadX 13156 0 4096 4096
ReadX 13156 4096 4096 4096
ReadX 13156 8192 4096 4096
ReadX 13156 12288 4096 4096
ReadX 13156 16384 4096 4096
ReadX 13156 20480 4096 4096
ReadX 13156 24576 4096 4096
ReadX 13156 28672 4096 4096
ReadX 13156 32768 4096 4096
ReadX 13156 36864 4096 4096
ReadX 13156 40960 4096 4096
ReadX 13156 45056 4096 4096
ReadX 13156 49152 4096 4096
ReadX 13156 53248 4096 4096
ReadX 13156 57344 4096 4096
ReadX 13156 61440 4096 4096
ReadX 13156 65536 4096 4096
ReadX 13156 69632 4096 4096
ReadX 13156 73728 4096 4096
WriteX 13156 0 4096 4096
Close 13156
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13157
Close 13157
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13158
ReadX 13158 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13159
Close 13159
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13158
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13161
WriteX 13161 4607 1 1
QUERY_FILE_INFORMATION 13161
WriteX 13161 0 65471 65471
WriteX 13161 65471 65 65
WriteX 13161 65536 19979 19979
Close 13161
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13162
ReadX 13162 0 4096 4096
WriteX 13162 0 4096 4096
Flush 13162
WriteX 13162 0 4096 4096
Flush 13162
QUERY_FILE_INFORMATION 13162
WriteX 13162 0 4096 4096
Flush 13162
WriteX 13162 0 4096 4096
Flush 13162
WriteX 13162 0 4096 4096
Flush 13162
WriteX 13162 0 4096 4096
Flush 13162
Close 13162
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13163
ReadX 13163 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13164
ReadX 13164 0 4096 4096
Close 13163
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13165
ReadX 13165 0 4096 4096
Close 13165
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13166
ReadX 13166 0 4096 4096
Close 13166
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13167
ReadX 13167 0 4096 4096
WriteX 13167 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13168
Close 13168
Close 13164
Close 13167
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13169
Close 13169
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13171
WriteX 13171 4607 1 1
QUERY_FILE_INFORMATION 13171
WriteX 13171 0 65471 65471
WriteX 13171 65471 65 65
WriteX 13171 65536 17654 17654
Close 13171
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13172
ReadX 13172 0 4096 4096
WriteX 13172 0 4096 4096
Flush 13172
WriteX 13172 0 4096 4096
Flush 13172
QUERY_FILE_INFORMATION 13172
WriteX 13172 0 4096 4096
Flush 13172
WriteX 13172 0 4096 4096
Flush 13172
WriteX 13172 0 4096 4096
Flush 13172
WriteX 13172 0 4096 4096
Flush 13172
Close 13172
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13173
Close 13173
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13174
ReadX 13174 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13175
Close 13175
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13176
ReadX 13176 0 4096 4096
ReadX 13176 4096 4096 4096
ReadX 13176 8192 4096 4096
ReadX 13176 12288 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13176 16384 4096 4096
ReadX 13176 20480 4096 4096
ReadX 13176 24576 4096 4096
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
Close 13174
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13177
ReadX 13177 0 4096 4096
Close 13177
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13178
ReadX 13178 0 4096 4096
Close 13178
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13179
ReadX 13179 0 4096 4096
WriteX 13179 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13180
Close 13180
Close 13179
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13181
Close 13181
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13183
WriteX 13183 4607 1 1
QUERY_FILE_INFORMATION 13183
WriteX 13183 0 65471 65471
WriteX 13183 65471 65 65
WriteX 13183 65536 19490 19490
Close 13183
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13184
ReadX 13184 0 4096 4096
WriteX 13184 0 4096 4096
Flush 13184
WriteX 13184 0 4096 4096
Flush 13184
QUERY_FILE_INFORMATION 13184
WriteX 13184 0 4096 4096
Flush 13184
WriteX 13184 0 4096 4096
Flush 13184
WriteX 13184 0 4096 4096
Flush 13184
WriteX 13184 0 4096 4096
Flush 13184
Close 13184
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13185
Close 13185
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13186
ReadX 13186 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13187
Close 13187
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13186
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13188
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13188 0 4096 4096
Close 13188
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13189
ReadX 13189 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13189
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13190
ReadX 13190 0 4096 4096
ReadX 13190 4096 4096 4096
ReadX 13190 8192 4096 4096
ReadX 13190 12288 4096 4096
ReadX 13190 16384 4096 4096
ReadX 13190 20480 4096 4096
ReadX 13190 24576 4096 4096
ReadX 13190 28672 4096 4096
ReadX 13190 32768 4096 4096
ReadX 13190 36864 4096 4096
ReadX 13190 40960 4096 4096
ReadX 13190 45056 4096 4096
ReadX 13190 49152 4096 4096
ReadX 13190 53248 4096 4096
ReadX 13190 57344 4096 4096
ReadX 13190 61440 4096 4096
ReadX 13190 65536 4096 4096
ReadX 13190 69632 4096 4096
ReadX 13190 73728 4096 4096
WriteX 13190 0 4096 4096
Close 13190
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13191
Close 13191
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13192
ReadX 13192 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13193
Close 13193
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13192
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13195
WriteX 13195 4607 1 1
QUERY_FILE_INFORMATION 13195
WriteX 13195 0 65471 65471
WriteX 13195 65471 65 65
WriteX 13195 65536 8866 8866
Close 13195
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13196
ReadX 13196 0 4096 4096
WriteX 13196 0 4096 4096
Flush 13196
WriteX 13196 0 4096 4096
Flush 13196
Close 13196
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13197
ReadX 13197 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13197
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13198
ReadX 13198 0 4096 4096
Close 13198
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13199
ReadX 13199 0 4096 4096
Close 13199
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13200
ReadX 13200 0 4096 4096
WriteX 13200 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13201
Close 13201
Close 13200
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13202
Close 13202
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13204
WriteX 13204 4607 1 1
QUERY_FILE_INFORMATION 13204
WriteX 13204 0 65471 65471
WriteX 13204 65471 65 65
WriteX 13204 65536 9298 9298
Close 13204
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13205
ReadX 13205 0 4096 4096
WriteX 13205 0 4096 4096
Flush 13205
WriteX 13205 0 4096 4096
Flush 13205
Close 13205
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13206
Close 13206
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13207
ReadX 13207 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13208
Close 13208
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13210
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13210 0 4096 4096
Close 13210
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13211
ReadX 13211 0 4096 4096
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13211 4096 4096 4096
ReadX 13211 8192 4096 4096
ReadX 13211 12288 4096 4096
ReadX 13211 16384 4096 4096
QUERY_FS_INFORMATION 259
Close 13207
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13212
ReadX 13212 0 4096 4096
Close 13212
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13213
ReadX 13213 0 4096 4096
Close 13213
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13214
ReadX 13214 0 4096 4096
WriteX 13214 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13215
Close 13215
Close 13211
Close 13214
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13216
Close 13216
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13218
WriteX 13218 4607 1 1
QUERY_FILE_INFORMATION 13218
WriteX 13218 0 65471 65471
WriteX 13218 65471 65 65
WriteX 13218 65536 11540 11540
Close 13218
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13219
ReadX 13219 0 4096 4096
WriteX 13219 0 4096 4096
Flush 13219
WriteX 13219 0 4096 4096
Flush 13219
Close 13219
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13220
Close 13220
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13221
ReadX 13221 0 4096 4096
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13222
Close 13222
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13221
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13223
ReadX 13223 0 65471 65471
ReadX 13223 65471 65 65
ReadX 13223 65536 65471 65471
ReadX 13223 131007 65 65
ReadX 13223 131072 65471 65471
ReadX 13223 196543 65 65
ReadX 13223 196608 65471 65471
ReadX 13223 262079 65 65
ReadX 13223 262144 65471 65471
ReadX 13223 327615 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13224
ReadX 13224 0 65471 65471
ReadX 13224 65471 65 65
ReadX 13224 65536 65471 65471
ReadX 13224 131007 65 65
ReadX 13224 131072 65471 65471
ReadX 13224 196543 65 65
ReadX 13224 196608 65471 65471
ReadX 13224 262079 65 65
ReadX 13224 262144 65471 65471
ReadX 13224 327615 65 65
ReadX 13224 327680 65471 65471
ReadX 13224 393151 65 65
ReadX 13224 393216 65471 65471
ReadX 13224 458687 65 65
ReadX 13224 458752 65471 65471
ReadX 13224 524223 65 65
ReadX 13224 524288 65471 65471
ReadX 13224 589759 65 65
ReadX 13224 589824 65471 65471
ReadX 13224 655295 65 65
ReadX 13224 655360 4096 4096
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13225
ReadX 13225 0 65471 65471
ReadX 13225 65471 65 65
ReadX 13225 65536 65471 65471
ReadX 13225 131007 65 65
ReadX 13225 131072 65471 65471
ReadX 13225 196543 65 65
ReadX 13225 196608 65471 65471
ReadX 13225 262079 65 65
ReadX 13225 262144 65471 65471
ReadX 13225 327615 65 65
ReadX 13225 327680 65471 65471
ReadX 13225 393151 65 65
ReadX 13225 393216 65471 65471
ReadX 13225 458687 65 65
ReadX 13225 458752 65471 65471
ReadX 13225 524223 65 65
ReadX 13225 524288 65471 65471
ReadX 13225 589759 65 65
ReadX 13225 589824 65471 65471
ReadX 13225 655295 65 65
ReadX 13225 655360 65471 65471
ReadX 13225 720831 65 65
ReadX 13225 720896 65471 65471
ReadX 13225 786367 65 65
ReadX 13225 786432 65471 65471
ReadX 13225 851903 65 65
ReadX 13225 851968 65471 65471
ReadX 13225 917439 65 65
ReadX 13225 917504 65471 65471
ReadX 13225 982975 65 65
ReadX 13225 983040 65471 65471
ReadX 13225 1048511 65 65
ReadX 13225 1048576 65471 65471
ReadX 13225 1114047 65 65
ReadX 13225 1114112 65471 65471
ReadX 13225 1179583 65 65
ReadX 13225 1179648 65471 65471
ReadX 13225 1245119 65 65
ReadX 13225 1245184 65471 65471
ReadX 13225 1310655 65 65
ReadX 13225 1310720 65471 65471
ReadX 13225 1376191 65 65
ReadX 13225 1376256 65471 65471
ReadX 13225 1441727 65 65
ReadX 13225 1441792 65471 65471
ReadX 13225 1507263 65 65
ReadX 13225 1507328 65471 65471
ReadX 13225 1572799 65 65
ReadX 13225 1572864 65471 65471
ReadX 13225 1638335 65 65
ReadX 13225 1638400 65471 65471
ReadX 13225 1703871 65 65
ReadX 13225 1703936 65471 65471
ReadX 13225 1769407 65 65
ReadX 13225 1769472 65471 65471
ReadX 13225 1834943 65 65
ReadX 13225 1835008 32768 32768
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13226
FIND_FIRST \clients\client1\~dmtmp\*
Close 13226
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13227
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13228
QUERY_FILE_INFORMATION 13228
QUERY_FILE_INFORMATION 13228
QUERY_FILE_INFORMATION 13228
ReadX 13228 2156 24 24
ReadX 13228 2139 276 276
ReadX 13228 2136 14 14
ReadX 13228 2136 7 7
ReadX 13228 2138 12 12
ReadX 13228 2137 8 8
ReadX 13228 2135 15 15
ReadX 13228 0 16 16
ReadX 13228 16 2048 2048
ReadX 13228 2064 2048 2048
ReadX 13228 257 2048 2048
ReadX 13228 385 2048 2048
ReadX 13228 513 2048 2048
ReadX 13228 641 2048 2048
ReadX 13228 769 2048 2048
ReadX 13228 897 2048 2048
ReadX 13228 1025 2048 2048
ReadX 13228 1153 2048 2048
ReadX 13228 1281 2048 2048
ReadX 13228 1409 2048 2048
ReadX 13228 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13230
Close 13230
Close 13176
Close 13223
Close 13224
Close 13225
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13232
WriteX 13232 15 1 1
QUERY_FILE_INFORMATION 13232
WriteX 13232 0 10575 10575
Flush 13232
Close 13232
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13233
Close 13233
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13234
ReadX 13234 0 4096 4096
Close 13228
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13235
Close 13235
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13236
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13237
QUERY_FILE_INFORMATION 13237
ReadX 13237 0 512 512
ReadX 13237 512 512 512
ReadX 13237 1024 512 512
QUERY_FILE_INFORMATION 13237
QUERY_FILE_INFORMATION 13237
Close 13237
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13238
QUERY_FILE_INFORMATION 13238
ReadX 13238 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13239
QUERY_FILE_INFORMATION 13239
ReadX 13239 0 512 512
ReadX 13239 512 512 512
ReadX 13239 1024 512 512
ReadX 13239 288 20 20
ReadX 13239 308 2084 2084
ReadX 13239 388 2084 2084
ReadX 13239 388 2084 2084
ReadX 13227 2157 1386 1386
ReadX 13239 2472 399 399
ReadX 13239 3072 1536 1536
ReadX 13239 544 149 149
ReadX 13239 693 485 485
Close 13239
ReadX 13227 2157 4096 4096
ReadX 13227 6253 4096 4096
ReadX 13227 10349 4096 4096
ReadX 13227 14445 4096 4096
ReadX 13227 18541 4096 4096
ReadX 13227 22637 256 256
ReadX 13227 22893 4096 4096
ReadX 13227 26989 4096 4096
ReadX 13227 31085 4096 4096
ReadX 13227 35181 4096 4096
ReadX 13227 39277 4096 4096
ReadX 13227 43373 4096 4096
ReadX 13227 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13227 2157 1024 1024
ReadX 13227 1667 4688 4688
ReadX 13227 6355 3516 3516
ReadX 13227 9871 16384 16384
ReadX 13227 26255 3771 3771
ReadX 13227 30026 2048 2048
ReadX 13227 32074 1024 1024
ReadX 13227 33098 6652 6652
ReadX 13227 39750 16384 16384
ReadX 13227 56134 10496 10496
ReadX 13227 66630 1784 1784
ReadX 13227 68414 90 90
ReadX 13227 68504 273 273
ReadX 13227 68777 1600 1600
ReadX 13227 70377 640 640
ReadX 13227 71017 1280 1280
ReadX 13227 72297 8464 8464
ReadX 13227 80761 158 158
ReadX 13227 80919 912 912
ReadX 13227 81831 1980 1980
ReadX 13227 83811 2256 2256
ReadX 13227 86067 400 400
ReadX 13227 86467 252 252
ReadX 13227 86719 42 42
ReadX 13227 86761 725 725
ReadX 13227 2009 512 512
ReadX 13227 3895 9 9
ReadX 13227 3781 46 46
ReadX 13227 4059 92 92
ReadX 13227 3781 92 92
ReadX 13227 3986 184 184
ReadX 13227 3987 16384 16384
ReadX 13227 3902 16384 16384
ReadX 13227 3781 10240 10240
ReadX 13227 3821 16384 16384
ReadX 13227 3891 935 935
ReadX 13227 4060 10240 10240
ReadX 13227 4059 184 184
ReadX 13227 256 184 184
ReadX 13227 256 1026 1026
ReadX 13227 3901 326 326
ReadX 13227 3899 652 652
ReadX 13227 256 2 2
ReadX 13227 258 4948 4948
Close 13227
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13241
Close 13241
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13243
WriteX 13243 4055 1 1
QUERY_FILE_INFORMATION 13243
WriteX 13243 0 65471 65471
WriteX 13243 65471 65 65
WriteX 13243 65536 65471 65471
WriteX 13243 131007 65 65
WriteX 13243 131072 65471 65471
WriteX 13243 196543 65 65
WriteX 13243 196608 65471 65471
WriteX 13243 262079 65 65
WriteX 13243 262144 65471 65471
WriteX 13243 327615 65 65
WriteX 13243 327680 65471 65471
WriteX 13243 393151 65 65
WriteX 13243 393216 65471 65471
WriteX 13243 458687 65 65
WriteX 13243 458752 65471 65471
WriteX 13243 524223 65 65
WriteX 13243 524288 65471 65471
WriteX 13243 589759 65 65
WriteX 13243 589824 35257 35257
Close 13243
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13245
Close 13245
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13247
WriteX 13247 4055 1 1
QUERY_FILE_INFORMATION 13247
WriteX 13247 0 65471 65471
WriteX 13247 65471 65 65
WriteX 13247 65536 65471 65471
WriteX 13247 131007 65 65
WriteX 13247 131072 65471 65471
WriteX 13247 196543 65 65
WriteX 13247 196608 65471 65471
WriteX 13247 262079 65 65
WriteX 13247 262144 65471 65471
WriteX 13247 327615 65 65
WriteX 13247 327680 65471 65471
WriteX 13247 393151 65 65
WriteX 13247 393216 65471 65471
WriteX 13247 458687 65 65
WriteX 13247 458752 65471 65471
WriteX 13247 524223 65 65
WriteX 13247 524288 65471 65471
WriteX 13247 589759 65 65
WriteX 13247 589824 57598 57598
Close 13247
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13249
WriteX 13249 15 1 1
QUERY_FILE_INFORMATION 13249
WriteX 13249 0 12543 12543
Flush 13249
Close 13249
Close 13234
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13250
Close 13250
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13251
ReadX 13251 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13252
FIND_FIRST \clients\client1\~dmtmp\*
Close 13252
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13253
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13254
QUERY_FILE_INFORMATION 13254
QUERY_FILE_INFORMATION 13254
QUERY_FILE_INFORMATION 13254
ReadX 13254 1938 24 24
ReadX 13254 1920 276 276
ReadX 13254 1918 14 14
ReadX 13254 1918 7 7
ReadX 13254 1919 12 12
ReadX 13254 1919 8 8
ReadX 13254 1917 15 15
ReadX 13254 0 16 16
ReadX 13254 16 2048 2048
ReadX 13254 2064 2048 2048
ReadX 13254 257 2048 2048
ReadX 13254 385 2048 2048
ReadX 13254 513 2048 2048
ReadX 13254 641 2048 2048
ReadX 13254 769 2048 2048
ReadX 13254 897 2048 2048
ReadX 13254 1025 2048 2048
ReadX 13254 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13256
Close 13256
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13258
WriteX 13258 15 1 1
QUERY_FILE_INFORMATION 13258
WriteX 13258 0 11588 11588
Flush 13258
Close 13258
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13259
Close 13259
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13260
ReadX 13260 0 4096 4096
Close 13254
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13262
WriteX 13262 15 1 1
QUERY_FILE_INFORMATION 13262
WriteX 13262 0 11615 11615
Flush 13262
Close 13262
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13260
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13263
Close 13263
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13264
ReadX 13264 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13266
Close 13266
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13268
WriteX 13268 4088 1 1
QUERY_FILE_INFORMATION 13268
WriteX 13268 0 65471 65471
WriteX 13268 65471 65 65
WriteX 13268 65536 16050 16050
Close 13268
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13253 1939 64 64
ReadX 13253 128 248 248
ReadX 13253 128 568 568
ReadX 13253 3872 1536 1536
ReadX 13253 3456 2560 2560
ReadX 13253 3136 512 512
ReadX 13253 2880 4096 4096
ReadX 13253 3264 3072 3072
ReadX 13253 320 4096 4096
ReadX 13253 1024 4096 4096
ReadX 13253 3616 4096 4096
ReadX 13253 1939 64 64
ReadX 13253 128 248 248
ReadX 13253 128 608 608
ReadX 13253 2858 1024 1024
ReadX 13253 2810 4096 4096
ReadX 13253 2826 4096 4096
ReadX 13253 2580 2048 2048
ReadX 13253 2800 2560 2560
ReadX 13253 2100 4096 4096
ReadX 13253 2084 4096 4096
ReadX 13253 868 4096 4096
ReadX 13253 2324 4096 4096
ReadX 13253 884 4096 4096
ReadX 13253 2604 1024 1024
ReadX 13253 580 4096 4096
ReadX 13253 596 4096 4096
ReadX 13253 2752 4096 4096
ReadX 13253 2842 1024 1024
ReadX 13253 660 4096 4096
ReadX 13253 2720 4096 4096
ReadX 13253 2736 4096 4096
ReadX 13253 628 4096 4096
ReadX 13253 2704 4096 4096
ReadX 13253 1556 4096 4096
ReadX 13253 576 4096 4096
ReadX 13253 3168 1536 1536
ReadX 13253 832 4096 4096
ReadX 13253 1088 4096 4096
ReadX 13253 1344 4096 4096
ReadX 13253 1600 4096 4096
ReadX 13253 1856 4096 4096
ReadX 13253 2112 4096 4096
ReadX 13253 1892 4096 4096
ReadX 13253 820 4096 4096
ReadX 13253 788 4096 4096
ReadX 13253 1604 4096 4096
ReadX 13253 3648 4096 4096
ReadX 13253 2608 4096 4096
ReadX 13253 548 4096 4096
ReadX 13253 740 4096 4096
ReadX 13253 1344 4096 4096
ReadX 13253 3392 4096 4096
ReadX 13253 3904 4096 4096
ReadX 13253 644 4096 4096
ReadX 13253 676 4096 4096
ReadX 13253 2688 4096 4096
ReadX 13253 320 4096 4096
ReadX 13253 900 4096 4096
ReadX 13253 1908 4096 4096
ReadX 13253 852 4096 4096
ReadX 13253 724 4096 4096
ReadX 13253 2292 4096 4096
ReadX 13253 612 4096 4096
ReadX 13253 388 4096 4096
ReadX 13253 2368 4096 4096
ReadX 13253 2624 4096 4096
ReadX 13253 500 4096 4096
ReadX 13253 356 4096 4096
ReadX 13253 1024 4096 4096
ReadX 13253 576 4096 4096
ReadX 13253 340 4096 4096
ReadX 13253 420 4096 4096
ReadX 13253 1600 4096 4096
ReadX 13253 404 4096 4096
ReadX 13253 1428 4096 4096
ReadX 13253 2656 4096 4096
ReadX 13253 2624 4096 4096
ReadX 13253 452 4096 4096
ReadX 13253 692 4096 4096
ReadX 13253 564 4096 4096
ReadX 13253 372 4096 4096
ReadX 13253 468 4096 4096
ReadX 13253 484 4096 4096
ReadX 13253 1088 4096 4096
ReadX 13253 1924 4096 4096
ReadX 13253 2768 4096 4096
ReadX 13253 832 4096 4096
ReadX 13253 836 4096 4096
ReadX 13253 1856 4096 4096
ReadX 13253 2640 4096 4096
ReadX 13253 436 4096 4096
ReadX 13253 1828 4096 4096
ReadX 13253 804 4096 4096
ReadX 13253 1860 4096 4096
ReadX 13253 1812 4096 4096
ReadX 13253 756 4096 4096
ReadX 13253 1636 4096 4096
ReadX 13253 772 4096 4096
ReadX 13253 2036 4096 4096
ReadX 13253 1220 4096 4096
ReadX 13253 1652 4096 4096
ReadX 13253 2588 4096 4096
ReadX 13253 916 4096 4096
ReadX 13253 260 4096 4096
ReadX 13253 932 4096 4096
ReadX 13253 2624 4096 4096
ReadX 13253 308 4096 4096
ReadX 13253 292 4096 4096
ReadX 13253 1140 4096 4096
ReadX 13253 276 4096 4096
ReadX 13253 2020 4096 4096
ReadX 13253 2880 4096 4096
ReadX 13253 516 4096 4096
ReadX 13253 1844 4096 4096
ReadX 13253 1124 4096 4096
ReadX 13253 3136 4096 4096
ReadX 13253 324 4096 4096
ReadX 13253 1156 4096 4096
ReadX 13253 1172 4096 4096
ReadX 13253 2112 4096 4096
ReadX 13253 2368 4096 4096
ReadX 13253 964 4096 4096
ReadX 13253 980 4096 4096
ReadX 13253 1012 4096 4096
ReadX 13253 532 4096 4096
ReadX 13253 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13253 1620 4096 4096
ReadX 13253 1604 4096 4096
ReadX 13253 2116 4096 4096
ReadX 13253 2132 4096 4096
ReadX 13253 2148 4096 4096
ReadX 13253 2276 4096 4096
ReadX 13253 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13270
Close 13270
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13272
QUERY_FILE_INFORMATION 13236
Close 13236
WriteX 13272 4088 1 1
QUERY_FILE_INFORMATION 13272
QUERY_FILE_INFORMATION 13238
Close 13238
WriteX 13272 0 65471 65471
WriteX 13272 65471 65 65
WriteX 13272 65536 64850 64850
Close 13272
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13274
WriteX 13274 15 1 1
QUERY_FILE_INFORMATION 13274
ReadX 13253 2068 4096 4096
ReadX 13253 1588 4096 4096
ReadX 13253 1572 4096 4096
WriteX 13274 0 18630 18630
Flush 13274
Close 13274
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13264
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13275
Close 13275
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13276
ReadX 13276 0 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13253 612 4096 4096
ReadX 13253 564 4096 4096
ReadX 13253 1876 4096 4096
ReadX 13253 628 4096 4096
ReadX 13253 740 4096 4096
ReadX 13253 724 4096 4096
ReadX 13253 644 4096 4096
ReadX 13253 2324 4096 4096
ReadX 13253 660 4096 4096
ReadX 13253 852 4096 4096
ReadX 13253 868 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
ReadX 13253 2368 4096 4096
ReadX 13253 1024 4096 4096
ReadX 13253 320 4096 4096
ReadX 13253 580 4096 4096
ReadX 13253 3136 512 512
ReadX 13253 2880 4096 4096
Close 13253
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13277
ReadX 13277 61440 4096 4096
ReadX 13277 126976 4096 4096
WriteX 13277 0 65471 65471
WriteX 13277 65471 65 65
WriteX 13277 65536 65471 65471
WriteX 13277 131007 65 65
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13278
ReadX 13278 61440 4096 4096
ReadX 13278 126976 4096 4096
ReadX 13278 192512 4096 4096
ReadX 13278 258048 4096 4096
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\mixfile
WriteX 13278 0 65471 65471
WriteX 13278 65471 65 65
WriteX 13278 65536 65471 65471
WriteX 13278 131007 65 65
WriteX 13278 131072 65471 65471
WriteX 13278 196543 65 65
WriteX 13278 196608 65471 65471
WriteX 13278 262079 65 65
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Close 13276
Close 13251
Close 13277
Close 13278
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\mixfile 0x40 0x5 13279
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\WORD\*
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
FIND_FIRST \clients\client1\~dmtmp\COREL\*
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
FIND_FIRST \clients\client1\~dmtmp\PM\*
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\FILLER"*
WriteX 13279 3 1 1
QUERY_FILE_INFORMATION 13279
WriteX 13279 0 4 4
WriteX 13279 4 8 8
Close 13279
Unlink \clients\client1\~dmtmp\WORD\CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\BASEMACH.DOC
Unlink \clients\client1\~dmtmp\WORD\FACTS.DOC
Unlink \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES.XLS
Unlink \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
Unlink \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA
Unlink \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
Unlink \clients\client1\~dmtmp\COREL\CDRROLS.CFG
Unlink \clients\client1\~dmtmp\COREL\CDRBARS.CFG
Unlink \clients\client1\~dmtmp\COREL\ARTISTIC.ACL
Unlink \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
Unlink \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
Unlink \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
Unlink \clients\client1\~dmtmp\COREL\SIGN2.CPT
Unlink \clients\client1\~dmtmp\COREL\TRAIN.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
Unlink \clients\client1\~dmtmp\COREL\ROSE.CPT
Unlink \clients\client1\~dmtmp\COREL\CORELDRW.CDT
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
Unlink \clients\client1\~dmtmp\PM\T1.XLS
Unlink \clients\client1\~dmtmp\PM\EVENTS.DOC
Unlink \clients\client1\~dmtmp\PM\MOVED.DOC
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.DB
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.PX
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.X04
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.Y04
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.PX
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.MB
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.DB
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.PX
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.X03
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.Y03
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.VAL
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.FSL
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
Unlink \clients\client1\~dmtmp\SEED\SMALL.FIL
Unlink \clients\client1\~dmtmp\SEED\MEDIUM.FIL
Unlink \clients\client1\~dmtmp\SEED\LARGE.FIL
Unlink \clients\client1\filler.000
Unlink \clients\client1\filler.001
Unlink \clients\client1\filler.002
Unlink \clients\client1\filler.003
Unlink \clients\client1\filler.004
Unlink \clients\client1\mixfile
Rmdir \clients\client1\~dmtmp\WORDPRO
Rmdir \clients\client1\~dmtmp\WORD
Rmdir \clients\client1\~dmtmp\SEED
Rmdir \clients\client1\~dmtmp\PWRPNT
Rmdir \clients\client1\~dmtmp\PM
Rmdir \clients\client1\~dmtmp\PARADOX
Rmdir \clients\client1\~dmtmp\EXCEL
Rmdir \clients\client1\~dmtmp\COREL
Rmdir \clients\client1\~dmtmp\ACCESS
Rmdir \clients\client1\~dmtmp
Rmdir \clients\client1